AIKIDO-2025-10243

TL;DR

Affected versions of the smol-toml package are vulnerable to a denial of service due to unbounded recursion when parsing or stringifying deeply nested inline structures. An attacker can craft a malicious TOML input to trigger a stack overflow and crash the application. The library does not impose a maximum depth limit for parsing or stringifying, increasing the risk of availability issues. The patched version introduces a configurable depth cap (default: 1000) to mitigate this, but nevertheless, users are advised to wrap parse and stringify calls in try/catch blocks when handling untrusted input.