[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
smol-toml	1.3.1 → 1.9.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines

GHSA-v3rj-xjv7-4jmq

More information

Details

Summary

An attacker can send a maliciously crafted TOML to cause the parser to crash, because of a stack overflow caused by thousands of consecutive commented lines.

The library uses recursion internally while parsing to skip over commented lines, which can be exploited to crash an application that is processing arbitrary TOML documents.

Proof of concept

require("smol-toml").parse('# comment\n'.repeat(8000) + 'key = "value"')

Impact

Applications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input. Downstream users are supposed to properly handle errors in such situations.

Due to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.

As a reminder, it is strongly advised when working with untrusted user input to expect errors to occur and to appropriately catch them.

Patches

Version 1.6.1 uses a different approach for parsing comments, which no longer involves recursion.

Workarounds

Wrap all invocations of parse and stringify in a try/catch block when dealing with untrusted user input.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-v3rj-xjv7-4jmq
• https://github.com/squirrelchat/smol-toml/releases/tag/v1.6.1
• https://github.com/advisories/GHSA-v3rj-xjv7-4jmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

smol-toml: Denial of Service via malformed TOML documents

CVE-2026-85730 / GHSA-7w5x-hrqm-74c2

More information

Details

Summary

parse() can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment "ends" the document).

The library fails to exit an internal loop when attempting to find the end of the structure, resetting its cursor to the beginning of the string instead. This causes the parser to indefinitely hang, compromising the availability of the service.

Proof of concept

import { parse } from 'smol-toml'
parse('a=[1 #')   // never returns; CPU pinned at 100%

Impact

Applications which parse arbitrary TOML documents can suffer major availability issues if they receive malicious input. This issue is particularly severe for these use-cases, and it is strongly advised to upgrade to an up-to-date version of the library as soon as possible.

If your use-case does not involve parsing arbitrary TOML documents from untrusted sources, the impact is much lower in practice, although it's still advisable to update to version 1.7.1.

Patches

Version 1.7.1 properly breaks out of the loop in these situations and throws the expected TomlError.

Workarounds

None that don't involve refactors. Update the library as soon as possible if your use-case involves parsing arbitrary TOML documents from untrusted sources.

Reported By : Ravindu Lakmina Munaweera

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2
• https://nvd.nist.gov/vuln/detail/CVE-2026-85730
• https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f
• https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1
• https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0
• https://github.com/advisories/GHSA-7w5x-hrqm-74c2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

GHSA-r4xh-jqrq-34v2

More information

Details

Summary

parse() has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey (dist/struct.js, lines 58 and 86) finds the dotted-key separator with ctx.s.indexOf('.', ctx.p), where ctx.s is the whole document. When a key has no . ahead of it, that search runs all the way to the end of the input, and the result is then clamped back to the line terminator endPtr - so everything scanned past the current line is wasted. parseKey runs once per line, so a document of N dot-free keys costs O(n^2).

The most ordinary TOML shape triggers it: a flat list of key = value lines, or a repeated [[a]] table. No dotted keys, no special options, valid input throughout.

Proof of concept

import { parse } from 'smol-toml'

let doc = ''
for (let i = 0; i < 256000; i++) doc += 'k' + i + ' = 1\n'

console.time('parse')
parse(doc) // ~2.8 MB of valid TOML, default options
console.timeEnd('parse')

Doubling the line count roughly quadruples the time:

lines	size	parse()
32k	0.3 MB	0.3 s
64k	0.7 MB	1.0 s
128k	1.4 MB	3.5 s
256k	2.8 MB	14 s

Impact

Any service that runs parse() on attacker-supplied TOML can be stalled. The work is synchronous, so it blocks the whole event loop, and the quadratic is unbounded: a ~7 MB body pins a core for about a minute, larger bodies for several.

Patches

Version 1.9.0 uses a different implementation for parsing keys which is strictly linear.

Workarounds

Limit the maximum document size accepted when parsing arbitrary documents.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-r4xh-jqrq-34v2
• https://github.com/squirrelchat/smol-toml/commit/99102aa57fc932f760ea9c15b4cf1c181f952d24
• https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.0
• https://github.com/advisories/GHSA-r4xh-jqrq-34v2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.