# smol-toml stack overflow via recursive comment parsing

Source: https://junglewise.ai/threats/smol-toml-stack-overflow-via-recursive-comment-parsing-8af08276  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-03-25

smol-toml is a JavaScript TOML configuration file parser used by many applications to read and validate structured data. An attacker can send a specially crafted TOML document with thousands of consecutive commented lines that causes the parser to crash through uncontrolled recursion, potentially disrupting the availability of any application that processes untrusted TOML input.

Technologies: [smol-toml (npm)](https://junglewise.ai/threats/technologies/smol-toml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 25 March 2026.

**Which products and versions are affected?** smol-toml (npm) SEMVER:introduced=0,fixed=1.6.1.

**Is there a fix for This vulnerability?** Yes. smol-toml (npm): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run smol-toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- smol-toml (npm): upgrade to 1.6.1 or later

  ```sh
  npm install smol-toml@1.6.1
  ```


## Technical details

The vulnerability is a stack overflow caused by uncontrolled recursion (CWE-674) in smol-toml's comment parsing logic. The parser uses recursive function calls to skip over consecutive comment lines; an attacker can exploit this by crafting a TOML document with 8000+ consecutive commented lines to exhaust the call stack and crash the application. The attack requires only network access and no authentication or user interaction. The library has no built-in guards limiting recursion depth. Version 1.6.1 patches the issue by replacing the recursive comment-parsing approach with an iterative one.

## Affected products

- SquirrelChat smol-toml <=1.6.0

## Timeline

- 2026-03-25: disclosed
- 2026-03-25: patched: Version 1.6.1 released

## References

- [https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-v3rj-xjv7-4jmq](https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-v3rj-xjv7-4jmq)
- [https://github.com/squirrelchat/smol-toml](https://github.com/squirrelchat/smol-toml)

## Related threats

- [smol-toml quadratic-time parse() from parseKey rescanning](https://junglewise.ai/threats/smol-toml-quadratic-time-parse-from-parsekey-rescanning-to-end-of-90b893fa)
- [smol-toml infinite loop in parser via malformed TOML](https://junglewise.ai/threats/cve-2026-85730-smol-toml-infinite-loop-in-parser-via-malformed-toml)
- [smol-toml denial of service via deeply nested inline tables](https://junglewise.ai/threats/smol-toml-denial-of-service-via-deeply-nested-inline-tables-8932a690)