Denial of Service Vulnerability in Conform Library by Edmund Hung
CVE-2026-49250
8.7HIGH
What is CVE-2026-49250?
The Conform library, used for type-safe form validation, contains a vulnerability that allows an unauthenticated attacker to exploit the parsing feature within nested objects. Specifically, in versions between 1.8.0 and 1.19.4, the parseSubmission API processes FormData or URLSearchParams entries by unique field names, enabling a crafted form submission to trigger excessive CPU resource consumption, leading to a denial-of-service condition in affected applications. Developers are advised to enforce request parsing limits to mitigate this vulnerability. This issue has been addressed in version 1.19.4.
Affected Version(s)
conform >= 1.8.0, < 1.19.4