smol-toml CVE-2026-85730

The application must accept and parse TOML input supplied or influenced by the attacker - for example, a configuration upload endpoint, a CI pipeline that reads TOML files from a repository, or any API that deserializes user-provided TOML. The malicious input must contain a value inside a TOML array or inline table followed by a comment character (#) with no trailing newline (i.e., the comment runs to end-of-file with no newline terminator). The CVSS 4.0 AT:P metric encodes this deployment prerequisite explicitly. Services that only parse internally generated or pre-validated TOML, or that enforce a newline at end of all TOML input, are not at risk. No authentication bypass or privilege escalation is involved - if the parsing endpoint requires authentication, the attacker must first authenticate before sending the crafted payload.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) scores 8.2, reflecting a network-reachable, low-complexity, unauthenticated trigger with full availability impact on the vulnerable process. The AT:P (attack target prerequisite) modifier is the key limiting factor: exploitation requires that the application accept and parse attacker-supplied TOML - a pattern common in configuration upload APIs, CI/CD pipelines that read repository TOML files, and any settings endpoint that deserializes user input. Where that condition is met, the attack is trivially simple: a single crafted string causes a Node.js event loop to spin at 100% CPU, blocking all subsequent request processing on that thread. No public exploit code has been identified at time of analysis, and the vulnerability is absent from CISA KEV, but the low construction complexity means any developer who reads the advisory can reproduce the trigger immediately. The CVSS 3.1 equivalent (7.5, AV:N/AC:L/PR:N/UI:N/S:U/A:H) is consistent and confirms the high-severity classification is accurate for deployments that expose TOML parsing to untrusted input.

An attacker submits a POST request to a publicly accessible configuration API that passes user-supplied TOML directly to smol-toml's parse() function, including the payload arr = [1

comment with no trailing newline at end of file. The parser enters skipUntil(), indexOfNewline() returns -1, the cursor resets to the string start, and the parser loops forever - consuming 100% of the Node.js thread and rendering the service unresponsive to all subsequent requests. In a single-process deployment, the service must be restarted to recover.