EUVD-2026-77679
GHSA-525m-7f82-2mf7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated form submission (AV:N/AC:L/PR:N/UI:N) with no confidentiality or integrity impact; availability set to Low as a single crafted request causes a CPU spike rather than guaranteed sustained outage.
Primary rating from Vendor (https://github.com/edmundhung/conform).
CVSS VectorVendor: https://github.com/edmundhung/conform
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 npm packages depend on @conform-to/dom (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.8.0.
DescriptionCVE.org
A CPU exhaustion vulnerability exists in Conform's parseSubmission future API when parsing FormData or URLSearchParams submissions with many unique field names. The parser previously looked up values by field name, which could require repeated scans of the submitted entries and cause excessive synchronous CPU work if an attacker supplies a crafted submission.
> [!NOTE] > The patched version fixes this by iterating submitted entries directly instead of repeatedly looking up values by field name. Applications that accept untrusted form submissions should still enforce request parsing limits before passing data to Conform. For multipart requests, @remix-run/form-data-parser provides maxParts, maxTotalSize, maxFileSize, maxFiles, and maxHeaderSize options.
AnalysisAI
Denial of service in Conform's parseSubmission future API allows remote attackers to exhaust server CPU by submitting FormData or URLSearchParams payloads containing many unique field names. Affecting the @conform-to/dom npm package used in React/Remix form-handling stacks, the flaw stems from the parser repeatedly scanning submitted entries during name-based value lookups, producing worst-case super-linear (effectively quadratic) synchronous work per request. There is no public exploit identified at time of analysis and no CISA KEV listing; impact is availability degradation rather than data exposure, despite the input's mislabeled 'Information Disclosure' tag.
Technical ContextAI
Conform is a progressive-enhancement form validation library for React (heavily used with Remix / React Router), and the affected component is its DOM/parsing package @conform-to/dom (pkg:npm/@conform-to_dom). The vulnerable parseSubmission future API converts a web-standard FormData or URLSearchParams object into a structured submission. The root cause maps to CWE-407 (Inefficient Algorithmic Complexity): the parser resolved each field by looking values up by name, which required repeated linear scans over all submitted entries - so with N unique field names the cost grows super-linearly (approaching O(N^2)). Because Node.js executes JavaScript on a single-threaded event loop, this synchronous CPU work blocks the process from servicing other requests for the duration, amplifying a single malicious submission into a broader stall. The patched version reportedly iterates the submitted entries directly instead of re-looking-up values by name, restoring linear-time parsing.
RemediationAI
Upgrade @conform-to/dom to the patched release, which iterates submitted entries directly rather than repeatedly looking up values by field name; the exact fixed version is not in the provided data, so consult GitHub advisory GHSA-525m-7f82-2mf7 (https://github.com/edmundhung/conform/security/advisories/GHSA-525m-7f82-2mf7) for the precise version and update accordingly - Patch available per vendor advisory. As a compensating control that the vendor explicitly recommends regardless of patch level, enforce request parsing limits before data reaches Conform: for multipart requests use @remix-run/form-data-parser with maxParts, maxTotalSize, maxFileSize, maxFiles, and maxHeaderSize; for urlencoded/FormData bodies, cap request body size and the number of accepted fields at the framework or reverse-proxy layer. Trade-off: setting these limits too low can reject legitimate large or file-heavy forms, so size them to real application needs. A reverse-proxy body-size cap (e.g. nginx client_max_body_size) is a low-effort stopgap that limits the attacker's field count without code changes.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today