AIKIDO-2026-768164
smol-toml is vulnerable to Denial of Service (DoS)
82
High Risk
This Affects:
smol-tomlTL;DR
The TOML parser can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that ends the document without a trailing newline. The internal routine that searches for the end of the structure fails to exit and resets its cursor to the start of the input instead of advancing. As a result the parse call hangs indefinitely and pins the CPU, so processing untrusted TOML input can exhaust availability. The fix breaks out of the loop in these cases and throws the expected parsing error.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse TOML documents from untrusted or externally influenced sources.
Background info
smol-toml is vulnerable to Denial of Service (DoS) in versions 1.0.1 - 1.7.0.
How to fix this
Upgrade the smol-toml library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant