EUVD-2026-71261
GHSA-7w5x-hrqm-74c2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges or interaction needed; sole impact is availability via infinite loop; scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5Blast Radius
ecosystem impact- 69 npm packages depend on smol-toml (50 direct, 21 indirect)
Ecosystem-wide dependent count for version 1.7.1.
DescriptionCVE.org
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
AnalysisAI
Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must accept and parse TOML input supplied or influenced by the attacker - for example, a configuration upload endpoint, a CI pipeline that reads TOML files from a repository, or any API that deserializes user-provided TOML. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) scores 8.2, reflecting a network-reachable, low-complexity, unauthenticated trigger with full availability impact on the vulnerable process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade smol-toml to version 1.7.1 or later (vendor-released patch: v1.7.1), available on npm and documented at https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all internal applications and services using smol-toml by examining npm dependencies and package-lock files, and determine which handle untrusted TOML input or expose parsing endpoints to external callers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today