PT-2024-40409 · Npm · Smol-Toml
Published
2024-11-22
·
Updated
2024-11-22
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
smol-toml versions prior to 1.3.1
Description
The issue arises from the library's lack of limitation on the maximum exploration depth while parsing or producing TOML documents, allowing an attacker to cause a stack overflow by sending a maliciously crafted TOML with deeply nested inline structures. This can lead to availability issues in applications that parse arbitrary TOML documents, potentially causing the application to crash if the error is not caught. However, due to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.
Recommendations
For versions prior to 1.3.1, as a temporary workaround, consider wrapping all invocations of
parse and stringify in a try/catch block to catch and handle potential errors. To fully resolve the issue, update to version 1.3.1, which introduces a mechanism to limit the exploration depth and provides a default cap of 1000, resulting in a controlled and documented behavior of the library.Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Smol-Toml