A high severity infinite loop vulnerability in the smol-toml parser allows unauthenticated attackers to trigger a denial of service condition by supplying malicious input.

This vulnerability is caused by an unchecked loop condition in the src/util.ts file, where the skipUntil function fails to exit properly when encountering specific comment structures at the end of an input string. An unauthenticated attacker can exploit this by providing a crafted TOML file to an application using the library, forcing the parser into an infinite loop that exhausts CPU resources.

The exploitation of this vulnerability results in a denial of service, which can lead to significant application downtime and loss of availability for critical services. With a CVSS score of 8.2, the impact on service availability is severe, potentially disrupting business operations that rely on the affected software for configuration or data parsing.

Immediate Action: Update the smol-toml package to version 1.7.1 or later to implement the fix in the skipUntil function.

Proactive Monitoring: Monitor server CPU utilization and application logs for unusual spikes or repeated parsing errors that may indicate exploitation attempts.

Compensating Controls: Implement input validation to sanitize or restrict the size and content of TOML files being parsed by the application, which may help mitigate the impact of malicious payloads.

Public Exploit Available: Unknown

Given the high severity of this vulnerability, organizations should prioritize updating the smol-toml library to version 1.7.1 immediately. Failure to address this flaw leaves systems susceptible to resource exhaustion attacks that can compromise service availability.