Uncontrolled Recursion Affecting smol-toml package, versions <1.6.1
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SMOLTOML-15768230
- published26 Mar 2026
- disclosed25 Mar 2026
- credit0xkakash1
Introduced: 25 Mar 2026
New CVE NOT AVAILABLE CWE-674 (opens in a new tab)How to fix?
Upgrade smol-toml to version 1.6.1 or higher.
Overview
smol-toml is an A small, fast, and correct TOML parser/serializer
Affected versions of this package are vulnerable to Uncontrolled Recursion. An attacker can cause the application to crash by submitting TOML documents containing thousands of consecutive commented lines, which triggers uncontrolled recursion and results in a stack overflow.
Workaround
This vulnerability can be mitigated by wrapping all invocations of parse and stringify in a try/catch block when dealing with untrusted user input.
PoC
require("smol-toml").parse('# comment\n'.repeat(8000) + 'key = "value"')