CVE-2026-85730
CVE-2026-85730 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-606.
Key facts
- Severity: High (CVSS 4.0 base score 8.2)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-606
- Published:
- Last modified:
Description
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
Frequently asked questions
- What is CVE-2026-85730?
- smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
- How severe is CVE-2026-85730?
- CVE-2026-85730 has a CVSS 4.0 base score of 8.2, rated high severity.
- Is CVE-2026-85730 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-85730?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-85730 published?
- CVE-2026-85730 was published on 2026-09-04 and last updated on 2026-09-09.
References
- https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f
- https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1
- https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2
- https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0
Other CWE-606 vulnerabilities
- CVE-2026-13761 — High (CVSS 8.8): Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop…
- CVE-2026-20301 — High (CVSS 8.6): A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol,…
- CVE-2026-27689 — High (CVSS 7.7): Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular…
- CVE-2026-62901 — High (CVSS 7.5): Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-1519 — High (CVSS 7.5): If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume…
- CVE-2025-43801 — High (CVSS 7.5): Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older…