smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an
    infinite loop when a value inside an array or inline table is followed by a comment with no trailing
    newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets
    the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs
    indefinitely and can consume a service's processing capacity when an application parses attacker-
    controlled TOML. This issue is fixed in version 1.7.1. (CVE-2026-85730)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an     infinite loop when a value inside an array or inline table is followed by a comment with no trailing     newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets     the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs     indefinitely and can consume a service's processing capacity when an application parses attacker-     controlled TOML. This issue is fixed in version 1.7.1. (CVE-2026-85730)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447862	SCA: security update for smol-toml (GHSA-7w5x-hrqm-74c2)	Tenable Cloud Security	SCA Checks	Local	high
447862	SCA: security update for smol-toml (GHSA-7w5x-hrqm-74c2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
342855	Linux Distros Unpatched Vulnerability : CVE-2026-85730	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85730

high

Tenable Plugins

high

high

high