Skip to content
Threat Feed
Subscribe

Product

Npm/@Conform-to/Dom (< 1.19.4)

1 brief RSS
medium advisory

@conform-to/dom Vulnerable to CPU Exhaustion via Crafted Form Submissions

A CPU exhaustion vulnerability (CVE-2026-49250) exists in Conform's `parseSubmission` API when parsing `FormData` or `URLSearchParams` with many unique field names, allowing an attacker to craft a submission that causes excessive synchronous CPU work and potential denial of service by repeatedly scanning submitted entries.

npm/@conform-to/dom vulnerability web-application denial-of-service cpu-exhaustion npm