Inefficient Algorithmic Complexity Affecting smol-toml package, versions <1.9.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SMOLTOML-20537050
- published6 Oct 2026
- disclosed5 Oct 2026
- creditNotAFlightRisk
Introduced: 5 Oct 2026
New CVE NOT AVAILABLE CWE-407 (opens in a new tab)How to fix?
Upgrade smol-toml to version 1.9.0 or higher.
Overview
smol-toml is an A small, fast, and correct TOML parser/serializer
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the parseKey function in src/struct.ts, which used the regular expression KEY_PART_RE (/^[a-zA-Z0-9-_]+[ \t]*$/) to validate bare key components. An attacker can supply a TOML document containing a long bare key with trailing characters that cause catastrophic backtracking in the regex engine, blocking the event loop and crashing the process.