Executive brief
smol-toml is a JavaScript TOML configuration file parser used by many applications to read and validate structured data. An attacker can send a specially crafted TOML document with thousands of consecutive commented lines that causes the parser to crash through uncontrolled recursion, potentially disrupting the availability of any application that processes untrusted TOML input.
Technical details
The vulnerability is a stack overflow caused by uncontrolled recursion (CWE-674) in smol-toml's comment parsing logic. The parser uses recursive function calls to skip over consecutive comment lines; an attacker can exploit this by crafting a TOML document with 8000+ consecutive commented lines to exhaust the call stack and crash the application. The attack requires only network access and no authentication or user interaction. The library has no built-in guards limiting recursion depth. Version 1.6.1 patches the issue by replacing the recursive comment-parsing approach with an iterative one.
Affected products
- SquirrelChat smol-toml <=1.6.0
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: Version 1.6.1 released