cargo audit: "error: failed to parse advisory database: invalid TOML in advisory"

Fix cargo audit "failed to parse advisory database: invalid TOML in advisory"

TL;DR

The cached RustSec advisory database on your machine is corrupted, usually from an interrupted fetch or a merge gone wrong. Delete the local advisory cache and let cargo audit re-download it. The error clears because the fresh database parses cleanly.

cargo audit: "error: failed to parse advisory database: invalid TOML in advisory"

Steps

1. Confirm the failure comes from the local cache, not your project. The error mentions the advisory database, so the fix is on the cache side.

   • Run: cargo audit --version
   • Expected: cargo audit prints its version, proving the binary itself is fine.

2. Remove the corrupted advisory database cache. cargo audit re-fetches it automatically on the next run.

   • Run: rm -rf ~/.cargo/advisory-dbs
   • Expected: the advisory-dbs directory is gone (verify with ls ~/.cargo/advisory-dbs showing no such directory).

3. Re-run cargo audit so it clones a fresh copy of the RustSec database.

   • Run: cargo audit
   • Expected: cargo audit fetches the database, then prints the audit results instead of the TOML error.

4. If the error returns on the next fetch, check your network path for anything rewriting the clone (proxies, caches, antivirus).

   • Run: cargo audit again and watch whether it fails during fetch or during parse
   • Expected: fetch completes and parse succeeds; if it still fails, the problem is in the download path, not the database.

Use this when

• cargo audit fails with "failed to parse advisory database: invalid TOML in advisory"
• The failure happens before any audit results, on every project
• You recently had a killed or interrupted cargo audit fetch

Not for this skill when

• cargo audit fails to download the database (SSL or network error - different fix)
• The TOML error is in your own Cargo.toml (check your project file instead)
• cargo audit reports actual vulnerabilities (the tool is working; triage the findings)

Variant phrasings

• cargo audit invalid TOML in advisory database
• cargo audit advisory db parse error
• cargo audit fails to parse rustsec database

Why it happens

cargo audit keeps a local git clone of the RustSec advisory database under ~/.cargo/advisory-dbs and parses every advisory TOML file on each run. If a fetch was interrupted, the disk filled up, or a bad merge landed in the clone, one or more advisory files are malformed and parsing the whole database fails. Deleting the clone forces a clean re-fetch, which restores well-formed advisories.

Edge cases

• The error persists after a fresh fetch: try removing the directory once more and fetching with a clean network (the first retry may have raced a stale git lock).
• You pinned an old advisory database on purpose: pin the full git state deliberately instead of relying on a half-fetched clone.
• Multiple users share the machine: each user's home has its own cache, so fix it for the user that runs the audit.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstKAsd5PMDcO09uG8086OWw