CVE-2026-49250
Received Received - Intake

Denial of Service in Conform Form Validation Library

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service in an application that passes the submission to parseSubmission. Applications should continue to enforce request parsing limits before invoking Conform. This issue is fixed in version 1.19.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-49250
EUVD
EUVD-2026-77679

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
edmundhung conform 1.19.4
edmundhung conform From 1.8.0 (inc) to 1.19.4 (inc)
edmundhung conform-dom 1.19.4
edmundhung conform-dom From 1.8.0 (inc) to 1.19.4 (inc)
conform-to react From 1.8.0 (inc) to 1.19.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49250 is a denial-of-service vulnerability in the Conform library's parseSubmission API. It occurs when processing form submissions with many unique field names, causing excessive CPU work due to repeated scans of FormData or URLSearchParams entries. The issue affects applications using the parseSubmission function from @conform-to/react/future with untrusted server-side form submissions.

Detection Guidance

Monitor for high CPU usage during form submissions. Check for excessive unique field names in FormData or URLSearchParams. Use server logs to identify submissions with abnormally large numbers of fields.

Impact Analysis

This vulnerability can lead to CPU exhaustion in your application, causing a denial of service. Attackers can submit crafted forms with many unique field names to trigger excessive synchronous CPU work, potentially crashing or severely degrading performance of your system.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by causing denial-of-service conditions through excessive CPU usage during form processing. Applications failing to enforce request parsing limits may expose systems to availability risks, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule).

Mitigation Strategies

Upgrade to Conform library version 1.19.4 or later. Implement request parsing limits before passing data to Conform, such as maxParts, maxTotalSize, maxFileSize, maxFiles, and maxHeaderSize for multipart requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart