CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents
An attacker can cause a denial of service by submitting malformed TOML data that triggers an infinite loop in the parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85730?
CVE-2026-85730 is a high-severity denial of service vulnerability in squirrelchat smol-toml, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
Which versions are affected by CVE-2026-85730?
2 open source packages ship an affected version, including smol-toml.
| Package | Affected | Fixed in |
|---|---|---|
smol-toml npm | All versions | 1.7.1 |
smol-toml npm | All versions | 1.7.1 |
How do I fix CVE-2026-85730?
Upgrade smol-toml to 1.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-85730 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85730 exists.
Sources
Also known as CLEANSTART-2026-HU00504, CLSA-2026-1790597280, ECHO-f81a-70d3-16d3, GHSA-7w5x-hrqm-74c2, MINI-678v-8prr-4wmj, MINI-m3fc-m53c-vqqr and 1 more.