{"vulnerability": "CVE-2026-85730", "sightings": [{"uuid": "35334f4b-831d-4467-b1e1-c99fe189852e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85730", "type": "seen", "source": "https://gist.github.com/alon710/d1e0c342d90c380e5c2e016452073fb0", "content": "# CVE-2026-85730: CVE-2026-85730: Infinite Loop Denial of Service in smol-toml Parser\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85730\n\n## Summary\nPrior to version 1.7.1, smol-toml is vulnerable to an infinite loop Denial of Service when parsing a malformed TOML payload containing an unclosed comment inside an array or inline table.\n\n## TL;DR\nA 5-byte malformed TOML payload can block the single-threaded Node.js event loop indefinitely, causing 100% CPU utilization and Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-85730\n- **CWE ID**: CWE-835 / CWE-606\n- **CVSS v4.0**: 8.2 (High)\n- **Attack Vector**: Network (AV:N)\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Listed**: No\n- **Affected Ecosystem**: npm (Node.js)\n\n## Affected Systems\n\n- smol-toml\n- **smol-toml**: < 1.7.1 (Fixed in: `1.7.1`)\n\n## Mitigation\n\n- Upgrade smol-toml dependency to version 1.7.1 or higher.\n- Deploy Web Application Firewall (WAF) filtering to identify malformed TOML comment structures.\n- Set up event loop block detection monitoring within Node.js runtimes.\n\n**Remediation Steps:**\n1. Identify usage of smol-toml in package.json and lockfiles.\n2. Run 'npm install smol-toml@latest' or corresponding command in yarn/pnpm to apply version 1.7.1.\n3. Audit production services to verify event loop response behaviors when exposed to malformed configurations.\n\n## References\n\n- [GitHub Security Advisory GHSA-7w5x-hrqm-74c2](https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2)\n- [Official Patch Commit](https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f)\n- [v1.7.1 Release Notes](https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1)\n- [Medium Article by Ravindu Lakmina Munaweera](https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-85730)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85730) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T19:31:51.897413Z"}, {"uuid": "510998be-76bc-474f-9381-57d7adadc8a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85730", "type": "published-proof-of-concept", "source": "https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2", "content": "", "creation_timestamp": "2026-09-09T20:35:03.086071Z"}]}