# smol-toml quadratic-time parse() from parseKey rescanning

Source: https://junglewise.ai/threats/smol-toml-quadratic-time-parse-from-parsekey-rescanning-to-end-of-90b893fa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2026-10-05

smol-toml is a JavaScript library that parses TOML configuration files. The parse() function has a performance flaw where parsing ordinary, valid TOML files with many simple key-value pairs causes the parser to spend quadratic time scanning through the document. An attacker could exploit this by supplying a maliciously large TOML file to cause a denial of service, blocking the entire application until parsing completes.

Technologies: [smol-toml (npm)](https://junglewise.ai/threats/technologies/smol-toml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 5 October 2026.

**Which products and versions are affected?** smol-toml (npm) <= 1.8.0; Smol-Toml before 1.9.0.

**Is there a fix for This vulnerability?** Yes: fixed in 1.9.0. Until then: Limit the maximum document size accepted when parsing arbitrary or untrusted TOML documents. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run smol-toml (npm) or Smol-Toml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.9.0

Limit the maximum document size accepted when parsing arbitrary or untrusted TOML documents.

## Technical details

The vulnerability is a quadratic-time algorithmic complexity issue in the parseKey() function (dist/struct.js, lines 58 and 86), which calls ctx.s.indexOf('.', ctx.p) on the entire document string for each key line. When no dotted key exists, the search scans to the end of the input before being clamped to the current line, wasting the work. This occurs on default options with valid TOML input, particularly flat key-value lists or repeated table headers. The attack is synchronous and blocks the event loop; a 7 MB document can pin a CPU core for approximately one minute.

## Affected products

- smol-toml smol-toml before 1.9.0

## Timeline

- 2026-10-05: disclosed: GitHub Security Advisory published

## Related threats

- [smol-toml infinite loop in parser via malformed TOML](https://junglewise.ai/threats/cve-2026-85730-smol-toml-infinite-loop-in-parser-via-malformed-toml)
- [smol-toml stack overflow via recursive comment parsing](https://junglewise.ai/threats/smol-toml-stack-overflow-via-recursive-comment-parsing-8af08276)
- [smol-toml denial of service via deeply nested inline tables](https://junglewise.ai/threats/smol-toml-denial-of-service-via-deeply-nested-inline-tables-8932a690)