CyberRota Analysis
AI-GeneratedThe Conform library, versions 1.8.0 to 1.19.4, is vulnerable to a denial-of-service attack due to its handling of nested object parsing in the parseSubmission API, which can be exploited by an unauthenticated attacker submitting a crafted form with numerous unique field names. This results in excessive CPU usage, potentially leading to application downtime. Developers and security teams using affected versions should prioritize updating to version 1.19.4 and implement request parsing limits to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service in an application that passes the submission to parseSubmission. Applications should continue to enforce request parsing limits before invoking Conform. This issue is fixed in version 1.19.4.