@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Description

A CPU exhaustion vulnerability exists in Conform’s parseSubmission future API when parsing FormData or URLSearchParams submissions with many unique field names.

Recommendation

Update the @conform-to/dom package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.8.0, < 1.19.4
• Patched version(s): 1.19.4

References

• GHSA-525m-7f82-2mf7
• CVE-2026-49250
• CWE-407
• CAPEC-310
• OWASP 2021-A6

Related Issues

• devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
• js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals - CVE-2026-49293
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@conform-to/dom