CVE-2026-85730: smol-toml: Denial of Service via malformed TOML documents

Vulnerability summary

CVE-2026-85730 is a high (CVSS 8.2) Unchecked Input for Loop Condition vulnerability in squirrelchat smol-toml. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

• CWE-606Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
• CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.