/ 
TOML-XS-0.01
⭐ Starred 5 / TOML::XS
Security Advisories (1)
CVE-2026-16634 (2026-07-24)

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.

NAME

TOML::XS - Parse TOML with XS

SYNOPSIS

# NB: Don’t read_text(), or stuff may break.
my $toml = File::Slurper::read_binary('/path/to/toml/file');

my $struct = TOML::XS::from_toml($toml)->to_struct();

DESCRIPTION

This module facilitates parsing of TOML documents in Perl via XS, which can yield significant performance gains relative to pure-Perl TOML libraries.

It is currently implemented as a wrapper around the tomlc99 C library.

FUNCTIONS

$doc = TOML::XS::from_toml($byte_string)

Converts a byte string (i.e., raw, undecoded bytes) that contains a serialized TOML document to a TOML::XS::Document instance.

MAPPING TOML TO PERL

Most TOML data items map naturally to Perl. The following details are relevant:

NOTE ON CHARACTER DECODING

This library mimics the default configuration of popular JSON modules: the TOML input to the parser is expected to be a byte string, while the strings that the parser outputs are character strings.

PERFORMANCE

For small- and medium-sized files this should be quite a bit faster than pure-Perl TOML parsers. With larger files the speed gains are more muted or even (??) reversed. (That’s an underlying issue with tomlc99.)

COPYRIGHT & LICENSE

Copyright 2021 Gasper Software Consulting. All rights reserved.

This library is licensed under the same license as Perl itself.

tomlc99 is licensed under the MIT License.