smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary parse() has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey (dist/struct.js, lines 58 and 86) finds the dotted-key separator with ctx.s.indexOf('.', ctx.p), where ctx.s is the whole document. When a key has no . ahead of it, that search runs all the way to the end of the input, and the result is then clamped back to the line terminator endPtr - so everything scanned past the current line is wasted. parseKey runs once per line, so a document of N dot-free keys costs O(n^2). The most ordinary TOML shape triggers it: a flat list of key = value lines, or a repeated [[a]] table. No dotted keys, no special options, valid input throughout. Proof of concept Doubling the line count roughly quadruples the time: | lines | size | parse() | |---|---|---| | 32k | 0.3 MB | 0.3 s | | 64k | 0.7 MB | 1.0 s | | 128k | 1.4 MB | 3.5 s | | 256k | 2.8 MB | 14 s | Impact Any service that runs parse() on…

Published by the source

5 Oct 2026, 23:41 UTC

Last modified by the source

6 Oct 2026, 00:00 UTC

Source last checked

26 Oct 2026, 13:06 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-r4xh-jqrq-34v2

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-r4xh-jqrq-34v2

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-r4xh-jqrq-34v2

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-r4xh-jqrq-34v2

Advisory: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
IDs: GHSA-r4xh-jqrq-34v2
Record: https://patchnext.com/advisories/ghsa-r4xh-jqrq-34v2 (revision 3, source checked 26 Oct 2026, 13:06 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: smol-toml 1.9.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm smol-toml: affected <= 1.8.0; fixed in 1.9.0

## Suggested inspection (read-only)
- `npm ls smol-toml --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on smol-toml.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-r4xh-jqrq-34v2 (GitHub-reviewed advisory GHSA-r4xh-jqrq-34v2 lists affected ranges: npm smol-toml >=0 <=1.8.0)
- Verified: https://osv.dev/vulnerability/GHSA-r4xh-jqrq-34v2 (OSV record GHSA-r4xh-jqrq-34v2 lists affected ranges: npm smol-toml >=0 <1.9.0 (fixed))

Commands are suggestions: review each one before running it.