diff --git a/.changeset/smol-toml-parser-dos.md b/.changeset/smol-toml-parser-dos.md
new file mode 100644
index 0000000000..61045d81aa
--- /dev/null
+++ b/.changeset/smol-toml-parser-dos.md
@@ -0,0 +1,10 @@
+---
+"wrangler": patch
+"create-cloudflare": patch
+"@cloudflare/workers-utils": patch
+"@cloudflare/workers-auth": patch
+---
+
+Update `smol-toml` to 1.8.0
+
+This updates the bundled TOML parser that reads `wrangler.toml` to a version that addresses two advisories against 1.5.2: `GHSA-7w5x-hrqm-74c2` (a value followed by a comment with no trailing newline, such as `a=[1 #`, put the parser in an infinite loop) and `GHSA-v3rj-xjv7-4jmq` (thousands of consecutive comment lines overflowed the stack). On the old version, `wrangler deploy` against a `wrangler.toml` ending in `a=[1 #` never returned; it now fails with `Invalid TOML document: cannot find end of structure`.
diff --git a/packages/workers-utils/tests/parse.test.ts b/packages/workers-utils/tests/parse.test.ts
index 340414b500..a8e57202c6 100644
--- a/packages/workers-utils/tests/parse.test.ts
+++ b/packages/workers-utils/tests/parse.test.ts
@@ -57,11 +57,11 @@ describe("parseTOML", () => {
 		} catch (err) {
 			expect({ ...(err as Error) }).toStrictEqual({
 				name: "ParseError",
-				text: "Invalid TOML document: only letter, numbers, dashes and underscores are allowed in keys",
+				text: "Invalid TOML document: unfinished string",
 				kind: "error",
 				location: {
 					line: 1,
-					column: 12,
+					column: 7,
 					fileText: "name = 'fail\"",
 					file: undefined,
 					lineText: "name = 'fail\"",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index cbc8cc6269..116272dbb1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -64,8 +64,8 @@ catalogs:
       specifier: 4.1.0
       version: 4.1.0
     smol-toml:
-      specifier: 1.5.2
-      version: 1.5.2
+      specifier: 1.8.0
+      version: 1.8.0
     tinyglobby:
       specifier: 0.2.16
       version: 0.2.16
@@ -2011,7 +2011,7 @@ importers:
         version: 7.7.1
       smol-toml:
         specifier: catalog:default
-        version: 1.5.2
+        version: 1.8.0
       tinyglobby:
         specifier: catalog:default
         version: 0.2.16
@@ -4254,7 +4254,7 @@ importers:
         version: 2.14.6(@types/node@22.15.17)(typescript@5.8.3)
       smol-toml:
         specifier: catalog:default
-        version: 1.5.2
+        version: 1.8.0
       ts-dedent:
         specifier: ^2.2.0
         version: 2.2.0
@@ -4529,7 +4529,7 @@ importers:
         version: 4.1.0
       smol-toml:
         specifier: catalog:default
-        version: 1.5.2
+        version: 1.8.0
       ts-dedent:
         specifier: ^2.2.0
         version: 2.2.0
@@ -4867,7 +4867,7 @@ importers:
         version: 4.1.0
       smol-toml:
         specifier: catalog:default
-        version: 1.5.2
+        version: 1.8.0
       supports-color:
         specifier: ^9.2.2
         version: 9.2.2
@@ -15540,8 +15540,8 @@ packages:
     resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==}
     engines: {node: '>= 6.0.0', npm: '>= 3.0.0'}
 
-  smol-toml@1.5.2:
-    resolution: {integrity: sha512-QlaZEqcAH3/RtNyet1IPIYPsEWAaYyXXv1Krsi+1L/QHppjX4Ifm8MQsBISz9vE8cHicIq3clogsheili5vhaQ==}
+  smol-toml@1.8.0:
+    resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==}
     engines: {node: '>= 18'}
 
   snake-case@3.0.4:
@@ -28314,7 +28314,7 @@ snapshots:
 
   smart-buffer@4.2.0: {}
 
-  smol-toml@1.5.2: {}
+  smol-toml@1.8.0: {}
 
   snake-case@3.0.4:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 6f7e4e08a9..67a38f6674 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -132,7 +132,7 @@ catalog:
   "@cloudflare/workers-types": "^5.20260921.1"
   workerd: "1.20260921.1"
   jsonc-parser: "3.2.0"
-  smol-toml: "1.5.2"
+  smol-toml: "1.8.0"
   msw: "2.14.6"
   tinyglobby: "0.2.16"
   "tree-kill": "1.2.2"