CVE-2026-49250High· 8.7▾ TwilightConform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or U…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 8.7
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service in an application that passes the submission to parseSubmission. Applications should continue to enforce request parsing limits before invoking Conform. This issue is fixed in version 1.19.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@conform-to/dom >= 1.8.0, < 1.19.4Patched in:
@conform-to/dom 1.19.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116795High· 7.5RE2JS: Quadratic-time denial of service in re2js lookbehind matching
CVE-2026-114141High· 8.7toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
CVE-2026-114143High· 8.7toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114129Medium· 6.2stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
CVE-2026-111758High· 7.5markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled