Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
🔴 smol-toml, Denial of Service, #CVE-2026-85730 (High) -DC-Sep2026-2298 https://dailycve.com/smol-toml-denial-of-service-cve-2026-85730-high-dc-sep2026-2298/
Post summary
The post announces a new high‑severity denial‑of‑service vulnerability (CVE‑2026‑85730) affecting smol‑toml, with no details on exploitation or mitigation provided.
🚨 Secured another CVE: CVE-2026-85730 7 bytes freeze a Node.js server running smol-toml (22M npm downloads/wk): a=[1 # An unterminated comment sends the parser's cursor to -1 → 0 → infinite loop. CPU pinned forever. Patched in 1.7.1. Write-up 👇 https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0?sharedUserId=ravindu.lakmina1
Post summary
CVE‑2026‑85730, a flaw in the smol‑toml parser, allows a 7‑byte payload to freeze a Node.js server via an infinite loop; the issue is patched in version 1.7.1 and detailed in a Medium write‑up.