{"answers":{"affected":"2 open source packages ship an affected version, including smol-toml.","exploited":"There is no known exploitation of GHSA-r4xh-jqrq-34v2 in the wild and no public exploit code.","fix":"Upgrade smol-toml to 1.9.0 or later.","what":"GHSA-r4xh-jqrq-34v2 is a denial of service vulnerability in smol-toml, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-r4xh-jqrq-34v2 and fix it if it is affected.\n\nWhat it is: GHSA-r4xh-jqrq-34v2 is a denial of service vulnerability in smol-toml, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-r4xh-jqrq-34v2 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- smol-toml (npm): affected all versions; fixed in 1.9.0\n- smol-toml (npm): affected all versions; fixed in 1.9.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/ (Markdown: https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/index.md)","id":"GHSA-r4xh-jqrq-34v2","markdown":"https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/index.md","name":"GHSA-r4xh-jqrq-34v2","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript TOML parser","requires_auth":"none","summary":"Attackers can cause denial of service in applications using smol-toml by submitting large valid TOML documents that trigger quadratic parsing time.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\n`parse()` has a quadratic-time path in `parseKey`, reachable on default options with ordinary valid input. For every key line and table-header line, `parseKey` (dist/struct.js, lines 58 and 86) finds the dotted-key separator with `ctx.s.indexOf('.', ctx.p)`, where `ctx.s` is the whole document. When a key has no `.` ahead of it, that search runs all the way to the end of the input, and the result is then clamped back to the line terminator `endPtr` - so everything scanned past the current line is wasted. `parseKey` runs once per line, so a document of N dot-free keys costs O(n^2).\n\nThe most ordinary TOML shape triggers it: a flat list of `key = value` lines, or a repeated `[[a]]` table. No dotted keys, no special options, valid input throughout.\n\n### Proof of concept\n\n```js\nimport { parse } from 'smol-toml'\n\nlet doc = ''\nfor (let i = 0; i \u003c 256000; i++) doc += 'k' + i + ' = 1\\n'\n\nconsole.time('parse')\nparse(doc) // ~2.8 MB of valid TOML, default options\nconsole.timeEnd('parse')\n```\n\nDoubling the line count roughly quadruples the time:\n\n| lines | size | parse() |\n|---|---|---|\n| 32k | 0.3 MB | 0.3 s |\n| 64k | 0.7 MB | 1.0 s |\n| 128k | 1.4 MB | 3.5 s |\n| 256k | 2.8 MB | 14 s |\n\n### Impact\nAny service that runs `parse()` on attacker-supplied TOML can be stalled. The work is synchronous, so it blocks the whole event loop, and the quadratic is unbounded: a ~7 MB body pins a core for about a minute, larger bodies for several.\n\n### Patches\nVersion 1.9.0 uses a different implementation for parsing keys which is strictly linear.\n\n### Workarounds\nLimit the maximum document size accepted when parsing arbitrary documents.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line","id":"GHSA-r4xh-jqrq-34v2","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["1.9.0"],"introduced":["0"],"last_affected":[],"package":"smol-toml","purl":null,"source":"GHSA-r4xh-jqrq-34v2"},{"ecosystem":"npm","fixed":["1.9.0"],"introduced":["0"],"last_affected":[],"package":"smol-toml","purl":"pkg:npm/smol-toml","source":"GHSA-r4xh-jqrq-34v2"}],"products":null,"published":"2026-10-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can cause denial of service in applications using smol-toml by submitting large valid TOML documents that trigger quadratic parsing time.","url":"https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/"}