---
title: "smol-toml security advisories"
description: "4 known security advisories for smol-toml, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/smol-toml/security
lang: en
---

[Packages](https://inlinr.com/packages)

# smol-toml

1.9.1 · 9 Oct 2026 BSD-3-Clause 63.2M / week [npm](https://www.npmjs.com/package/smol-toml) [Atom feed](https://inlinr.com/packages/feed/smol-toml)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                           |
| ---- | ------ | ------------------------------------------------------------------------- |
|      | 1.9.1  | Safe from 1.9.0                                                           |
|      | 0.1.0  | 4 open advisories, worst high  · last release May 2023, no longer updated |

- High  
[smol-toml: Denial of Service via malformed TOML documents](https://inlinr.com/advisories/GHSA-7w5x-hrqm-74c2)GHSA-7w5x-hrqm-74c2 · 9 Sep 2026  
fixed in 1.7.1
- Moderate  
[smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line](https://inlinr.com/advisories/GHSA-r4xh-jqrq-34v2)GHSA-r4xh-jqrq-34v2 · 5 Oct 2026  
fixed in 1.9.0
- Moderate  
[smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines](https://inlinr.com/advisories/GHSA-v3rj-xjv7-4jmq)GHSA-v3rj-xjv7-4jmq · 25 Mar 2026  
fixed in 1.6.1
- Moderate  
[smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables](https://inlinr.com/advisories/GHSA-pqhp-25j4-6hq9)GHSA-pqhp-25j4-6hq9 · 22 Nov 2024  
fixed in 1.3.1

### Quality and security signals

What [npm](https://www.npmjs.com/package/smol-toml) and [deps.dev](https://deps.dev/npm/smol-toml) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 5 Nov 2026\. Releases and advisories last read 5 Nov 2026.