smol-toml (npm)
A small, fast, and correct TOML (1.1.0) parser and serializer
Advisories
7
Latest version
1.9.1
Released Oct 9, 2026
License
BSD-3-Clause
OpenSSF Scorecard
—
How to fix
Upgrading to 1.9.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install smol-toml@1.9.1yarn
yarn add smol-toml@1.9.1pnpm
pnpm add smol-toml@1.9.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r4xh-jqrq-34v2 smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line |
Medium | < 1.9.0 | 1.9.0 |
| GHSA-r4xh-jqrq-34v2 smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line |
Medium | <= 1.8.0 | No fix yet |
| GHSA-7w5x-hrqm-74c2 smol-toml: Denial of Service via malformed TOML documents |
High EPSS 0.52% |
<= 1.7.0 | No fix yet |
| GHSA-7w5x-hrqm-74c2 smol-toml: Denial of Service via malformed TOML documents |
High EPSS 0.52% |
< 1.7.1 | 1.7.1 |
| GHSA-v3rj-xjv7-4jmq smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines |
Medium | < 1.6.1 | 1.6.1 |
| GHSA-v3rj-xjv7-4jmq smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines |
Medium | < 1.6.1 | 1.6.1 |
| GHSA-pqhp-25j4-6hq9 smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables |
Medium | < 1.3.1 | 1.3.1 |
Source: github:squirrelchat/smol-toml
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor