# GHSA-r4xh-jqrq-34v2: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

> Attackers can cause denial of service in applications using smol-toml by submitting large valid TOML documents that trigger quadratic parsing time.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 5 Oct 2026

## What is GHSA-r4xh-jqrq-34v2?

GHSA-r4xh-jqrq-34v2 is a denial of service vulnerability in smol-toml, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary

`parse()` has a quadratic-time path in `parseKey`, reachable on default options with ordinary valid input. For every key line and table-header line, `parseKey` (dist/struct.js, lines 58 and 86) finds the dotted-key separator with `ctx.s.indexOf('.', ctx.p)`, where `ctx.s` is the whole document. When a key has no `.` ahead of it, that search runs all the way to the end of the input, and the result is then clamped back to the line terminator `endPtr` - so everything scanned past the current line is wasted. `parseKey` runs once per line, so a document of N dot-free keys costs O(n^2).

The most ordinary TOML shape triggers it: a flat list of `key = value` lines, or a repeated `[[a]]` table. No dotted keys, no special options, valid input throughout.

### Proof of concept

```js
import { parse } from 'smol-toml'

let doc = ''
for (let i = 0; i < 256000; i++) doc += 'k' + i + ' = 1\n'

console.time('parse')
parse(doc) // ~2.8 MB of valid TOML, default options
console.timeEnd('parse')
```

Doubling the line count roughly quadruples the time:

| lines | size | parse() |
|---|---|---|
| 32k | 0.3 MB | 0.3 s |
| 64k | 0.7 MB | 1.0 s |
| 128k | 1.4 MB | 3.5 s |
| 256k | 2.8 MB | 14 s |

### Impact
Any service that runs `parse()` on attacker-supplied TOML can be stalled. The work is synchronous, so it blocks the whole event loop, and the quadratic is unbounded: a ~7 MB body pins a core for about a minute, larger bodies for several.

### Patches
Version 1.9.0 uses a different implementation for parsing keys which is strictly linear.

### Workarounds
Limit the maximum document size accepted when parsing arbitrary documents.

## Which versions are affected by GHSA-r4xh-jqrq-34v2?

2 open source packages ship an affected version, including smol-toml.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `smol-toml` | npm | All versions | 1.9.0 |
| `smol-toml` | npm | All versions | 1.9.0 |

## How do I fix GHSA-r4xh-jqrq-34v2?

Upgrade smol-toml to 1.9.0 or later.

## Is GHSA-r4xh-jqrq-34v2 being exploited?

There is no known exploitation of GHSA-r4xh-jqrq-34v2 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-r4xh-jqrq-34v2 and fix it if it is affected.

What it is: GHSA-r4xh-jqrq-34v2 is a denial of service vulnerability in smol-toml, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-r4xh-jqrq-34v2 in the wild and no public exploit code.

Affected packages and fixed versions:
- smol-toml (npm): affected all versions; fixed in 1.9.0
- smol-toml (npm): affected all versions; fixed in 1.9.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/ (Markdown: https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-r4xh-jqrq-34v2

---
From sbomify Insights: https://insights.sbomify.com/GHSA-r4xh-jqrq-34v2/
Summaries are generated and may contain mistakes; the official description above is the record.