CVE-2026-85730: smol-toml Parser DOS Vulnerability

CVE-2026-85730 Overview

CVE-2026-85730 is a denial-of-service vulnerability in smol-toml, a TOML parser and serializer widely used in Node.js applications. Versions prior to 1.7.1 contain a flaw in the parse() function that causes an infinite loop when processing malformed TOML input. Specifically, a value inside an array or inline table followed by a comment without a trailing newline triggers the condition. The parser hangs indefinitely, consuming a service's processing capacity when it parses attacker-controlled TOML. The issue is classified under [CWE-606: Unchecked Input for Loop Condition] and is fixed in version 1.7.1.

Critical Impact
A remote unauthenticated attacker can submit a small TOML payload that causes the parser to enter an infinite loop, exhausting CPU resources and rendering the Node.js service unresponsive.

Affected Products

smol-toml versions prior to 1.7.1
Node.js applications that parse untrusted TOML using smol-toml
Downstream libraries and services bundling vulnerable smol-toml releases

Discovery Timeline

2026-09-04 - CVE-2026-85730 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85730

Vulnerability Analysis

The defect resides in src/util.ts, in the skipUntil() helper used during structure scanning. When skipUntil() invokes indexOfNewline() and receives -1 at end of input, it resets the cursor to the beginning of the string rather than exiting the scan. The parser then re-enters the same code path indefinitely.

The trigger is a value inside an array or inline table followed by a comment with no terminating newline. Because the input contains no newline, indexOfNewline() never returns a valid offset. The resulting infinite loop consumes a single-threaded Node.js event loop, blocking all other request handling on that process.

Exploitation requires only that an application invoke parse() on attacker-controlled TOML. Configuration loaders, package manifest parsers, and web endpoints accepting TOML payloads are typical exposure points.

Root Cause

The root cause is unchecked handling of the sentinel -1 return value from indexOfNewline(). Instead of terminating the scan when no newline exists, skipUntil() reuses the return value as an index and resets scanning to the string start. This creates a loop condition controlled entirely by the input.

Attack Vector

An unauthenticated remote attacker delivers a minimal TOML payload containing an inline table or array element followed by a comment with no trailing newline. The victim application parses the payload with smol-toml, and the Node.js event loop stalls until the process is terminated or restarted.

typescript

// Patch reference from src/extract.ts
/** @internal */
export function extractValue(str: string, ptr: number, end: string | undefined, depth: number, integersAsBigInt: IntegersAsBigInt): [TomlValue, number] {
	if (depth === 0) {
		throw new TomlError('document contains excessively nested structures. aborting.', {
// Source: https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f

Detection Methods for CVE-2026-85730

Indicators of Compromise

Node.js processes pinned at 100% CPU utilization on a single core with no forward progress in request logs
Health checks failing on services that accept TOML input, followed by process restarts by a supervisor such as pm2 or systemd
Inbound HTTP requests carrying Content-Type: application/toml or file uploads with .toml extensions preceding hangs

Detection Strategies

Inventory dependency trees using npm ls smol-toml or yarn why smol-toml to identify vulnerable versions before 1.7.1
Enable Software Composition Analysis (SCA) rules in CI pipelines to flag builds referencing vulnerable smol-toml releases
Add runtime instrumentation that measures parse() execution time and alerts on calls exceeding a configured threshold

Monitoring Recommendations

Track per-process CPU time and event loop lag using tools such as clinic.js or the perf_hooks module
Alert on repeated worker restarts and elevated 5xx response rates on endpoints that consume TOML
Correlate request payload sizes and content types with subsequent CPU spikes to identify malicious submissions

How to Mitigate CVE-2026-85730

Immediate Actions Required

Upgrade smol-toml to version 1.7.1 or later across all applications and container images
Audit transitive dependencies and rebuild lockfiles so downstream packages pull the patched release
Restrict endpoints that parse TOML to authenticated users where feasible, and impose strict payload size limits

Patch Information

The fix is included in smol-toml v1.7.1. Technical details are available in the GHSA-7w5x-hrqm-74c2 security advisory and the upstream commit.

Workarounds

Wrap parse() calls in a worker thread with a timeout so a hung parse can be terminated without killing the main process
Reject inbound TOML payloads that lack a trailing newline or exceed a conservative byte limit before parsing
Place a Web Application Firewall (WAF) rule in front of TOML-accepting endpoints to drop requests with suspicious content patterns

bash

# Upgrade to the patched release
npm install smol-toml@^1.7.1

# Verify the resolved version
npm ls smol-toml