CVE-2026-49250

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service in an application that passes the submission to parseSubmission. Applications should continue to enforce request parsing limits before invoking Conform. This issue is fixed in version 1.19.4.

• CWE-407

• https://github.com/edmundhung/conform/commit/f9a1e696ef950efcada5f06ea2b202da505bf9b0
• https://github.com/edmundhung/conform/releases/tag/v1.19.4
• https://github.com/edmundhung/conform/security/advisories/GHSA-525m-7f82-2mf7

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49245SFTPGo is an open source, event-driven file transfer solutio…3.7
• CVE-2026-49246Jellyfin is an open source self hosted media server. Prior t…1.7
• CVE-2026-49247Jellyfin is an open source self hosted media server. From 10…8.8
• CVE-2026-49248OneDev is a Git server with CI/CD, kanban, and packages. In …8.3
• CVE-2026-49249Boruta is a standalone authorization server that aims to imp…7.1
• CVE-2026-4925Improper access control in the users MFA feature in Devoluti…5
• CVE-2026-49252deepstream is a server that allows clients and backend servi…9.9
• CVE-2026-49253electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.1
• CVE-2026-49254Dragonfly is an open source P2P-based file distribution and …2.9
• CVE-2026-49255electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…8.8
• CVE-2026-49256Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-49257mcp-pinot is a Python-based Model Context Protocol (MCP) ser…10