smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an
    infinite loop when a value inside an array or inline table is followed by a comment with no trailing
    newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets
    the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs
    indefinitely and can consume a service's processing capacity when an application parses attacker-
    controlled TOML. This issue is fixed in version 1.7.1. (CVE-2026-85730)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2c004657ff advisory.

    Update

    ----

    CVE fix



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-af15ed670a advisory.

    Update

    ----

    CVE fix


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an     infinite loop when a value inside an array or inline table is followed by a comment with no trailing     newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets     the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs     indefinitely and can consume a service's processing capacity when an application parses attacker-     controlled TOML. This issue is fixed in version 1.7.1. (CVE-2026-85730)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474615	Echo: smol-toml: security update to 1.7.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
474615	Echo: smol-toml: security update to 1.7.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
364661	Fedora 44 : markdownlint-cli2 (2026-2c004657ff)	Nessus	Fedora Local Security Checks	Local	high
364652	Fedora 43 : markdownlint-cli2 (2026-af15ed670a)	Nessus	Fedora Local Security Checks	Local	high
447862	SCA: security update for smol-toml (GHSA-7w5x-hrqm-74c2)	Tenable Cloud Security	SCA Checks	Local	high
447862	SCA: security update for smol-toml (GHSA-7w5x-hrqm-74c2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
342855	Linux Distros Unpatched Vulnerability : CVE-2026-85730	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85730

high

Tenable Plugins

high

high

high

high

high

high

high