CVE-2026-85730: CVE-2026-85730: Infinite Loop Denial of Service in smol-toml Parser

#security #cve #cybersecurity

CVE-2026-85730: Infinite Loop Denial of Service in smol-toml Parser

Vulnerability ID: CVE-2026-85730
CVSS Score: 8.2
Published: 2026-09-09

Prior to version 1.7.1, smol-toml is vulnerable to an infinite loop Denial of Service when parsing a malformed TOML payload containing an unclosed comment inside an array or inline table.

TL;DR

A 5-byte malformed TOML payload can block the single-threaded Node.js event loop indefinitely, causing 100% CPU utilization and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: CVE-2026-85730
CWE ID: CWE-835 / CWE-606
CVSS v4.0: 8.2 (High)
Attack Vector: Network (AV:N)
Exploit Status: Proof of Concept (PoC)
CISA KEV Listed: No
Affected Ecosystem: npm (Node.js)

Affected Systems

smol-toml
smol-toml: < 1.7.1 (Fixed in: 1.7.1)

Code Analysis

Commit: 30f5c36

fix: infinite loop on unclosed comments in arrays/inline tables

Exploit Details

Medium Write-up: Seven Bytes That Freeze a Node.js Server Forever : The Story of CVE-2026-85730

Mitigation Strategies

Upgrade smol-toml dependency to version 1.7.1 or higher.
Deploy Web Application Firewall (WAF) filtering to identify malformed TOML comment structures.
Set up event loop block detection monitoring within Node.js runtimes.

Remediation Steps:

Identify usage of smol-toml in package.json and lockfiles.
Run 'npm install smol-toml@latest' or corresponding command in yarn/pnpm to apply version 1.7.1.
Audit production services to verify event loop response behaviors when exposed to malformed configurations.

References

Read the full report for CVE-2026-85730 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community