CVE-2026-85730

smol-toml, a TOML parser and serializer distributed via npm, contained a denial-of-service flaw (fixed in 1.7.1) in which parse() enters an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline. In that case skipUntil() calls indexOfNewline(), which returns -1 at the end of input, and the helper resets the scan cursor to the beginning of the string, so the parser hangs indefinitely. An attacker who can supply TOML input to an application running an affected version gains a remote denial of service, hanging the process and consuming the service's processing capacity; the CVSS 4.0 score of 8.2 reflects high availability impact with no confidentiality or integrity impact. Any npm application or service that parses attacker-controlled TOML with smol-toml prior to 1.7.1 is affected. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade smol-toml to 1.7.1 or later, including updating lockfiles where it appears as a transitive dependency (search npm/yarn/pnpm lockfiles for smol-toml). Until patched, avoid parsing untrusted TOML with affected versions, or pre-screen/reject input containing comments without a trailing newline inside arrays or inline tables, and consider enforcing a parse timeout. Note the trigger condition when reviewing any service that accepts TOML configuration or user-supplied TOML input.