GHSA-v3rj-xjv7-4jmq
Medium · 5.3CVSS
5.3
EPSS
—
Published
Mar 25, 2026
CISA due date
—
The record
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | smol-toml | 0 | 1.6.1 |
| Chainguard | renovate | 0 | 43.104.7-r1 |
| Wolfi | renovate | 0 | 43.104.7-r1 |
Related vulnerabilities
- CVE-2026-35209 defu is software that allows uers to assign default properties recursively. Also affects renovate
- GHSA-737v-mqg7-c878 defu: Prototype pollution via `__proto__` key in defaults argument Also affects renovate
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects renovate
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects renovate
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects renovate
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects renovate
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects renovate
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects renovate