CVE-2026-108545: SillyTavern DoS Vulnerability

CVE-2026-108545 Overview

CVE-2026-108545 is a pre-authentication denial of service vulnerability affecting SillyTavern versions 1.12.13 through 1.19.0. The flaw stems from body-parser middleware executing before authentication and IP whitelist checks in the Express application pipeline. Unauthenticated remote attackers can submit large or compressed JSON and urlencoded request bodies up to 500 MB, optionally in parallel, to exhaust server memory and CPU resources. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Unauthenticated attackers can remotely crash or render SillyTavern instances unresponsive by sending oversized or compressed request bodies, with no credentials or user interaction required.

Affected Products

SillyTavern 1.12.13
SillyTavern versions between 1.12.13 and 1.19.0
SillyTavern 1.19.0

Discovery Timeline

2026-10-10 - CVE-2026-108545 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108545

Vulnerability Analysis

SillyTavern is an open-source front-end for interacting with large language models. The server component uses Express with body-parser middleware to process incoming HTTP request bodies. The middleware pipeline parses request payloads before authentication and whitelist enforcement run, meaning any network-reachable client can submit arbitrary bodies for parsing.

The middleware configuration permits JSON and URL-encoded bodies up to 500 MB and accepts compressed payloads. An attacker can send small, highly compressed requests that expand to large in-memory structures, or submit many large bodies concurrently. Both patterns consume disproportionate memory and CPU, triggering process degradation or termination.

Because the parsing occurs before access controls, binding SillyTavern to a trusted network or configuring a whitelist does not mitigate the exposure once the TCP port is reachable.

Root Cause

The root cause is middleware ordering in src/server-main.js. The body-parser handlers are registered on the Express application before the authentication and whitelist middlewares. Combined with a 500 MB body limit and acceptance of compressed encodings, this allows unauthenticated resource consumption. Review the vulnerable code region for the specific registration order.

Attack Vector

Exploitation requires only network access to the SillyTavern HTTP listener. An attacker issues HTTP POST or PUT requests with a Content-Type of application/json or application/x-www-form-urlencoded. Payloads are maximized in size, or compressed with gzip or deflate to amplify the parsing cost. Parallel requests multiply resource pressure. Additional analysis is documented in the HackMD write-up and the VulnCheck advisory.

// No verified exploit code is published. The attack pattern consists of
// sending oversized or compressed JSON/urlencoded bodies to any route
// before authentication middleware executes. See the HackMD analysis
// and VulnCheck advisory for technical details.

Detection Methods for CVE-2026-108545

Indicators of Compromise

Repeated inbound HTTP POST or PUT requests to SillyTavern endpoints with Content-Length values approaching 500 MB.
Requests carrying Content-Encoding: gzip or Content-Encoding: deflate with unusually small compressed sizes but large declared or decompressed sizes.
SillyTavern process crashes, out-of-memory kills, or sustained CPU saturation correlated with inbound traffic bursts.
Spikes in concurrent connections from a small number of source IP addresses to the SillyTavern listener.

Detection Strategies

Deploy a reverse proxy or Web Application Firewall in front of SillyTavern and alert on request bodies exceeding a defined threshold such as 1 MB.
Monitor process memory and CPU metrics for the SillyTavern node process and alert on rapid growth.
Enable HTTP access logging and detect anomalies in Content-Length, Content-Encoding, and request rate per source.

Monitoring Recommendations

Forward SillyTavern HTTP logs and host telemetry to a centralized analytics platform for correlation.
Track baseline request size distributions and alert on statistical outliers.
Monitor for repeated TCP resets or 502/504 responses from upstream proxies serving SillyTavern.

How to Mitigate CVE-2026-108545

Immediate Actions Required

Restrict network access to the SillyTavern listener using firewall rules, VPN, or private networking so it is not exposed to untrusted networks.
Place SillyTavern behind a reverse proxy such as nginx or Caddy and enforce a strict client_max_body_size limit.
Disable or reject requests with Content-Encoding: gzip or deflate at the proxy layer if compressed uploads are not required.
Rate-limit inbound requests per source IP at the proxy or WAF layer.

Patch Information

No fixed version is listed in the published NVD entry at the time of writing. Monitor the SillyTavern GitHub repository and the VulnCheck advisory for an upstream fix that reorders middleware so authentication and whitelist checks run before body-parser, and that reduces the maximum accepted body size.

Workarounds

Terminate TLS and HTTP parsing at a hardened reverse proxy with a low client_max_body_size such as 1 MB.
Bind SillyTavern to 127.0.0.1 and tunnel access through SSH or a VPN rather than exposing the port directly.
Run SillyTavern under a process manager with memory limits so a resource spike restarts the service instead of exhausting the host.
Apply fail2ban or similar tooling against proxy access logs to block sources generating oversized requests.

bash

# nginx reverse proxy snippet to cap request body size
server {
    listen 443 ssl;
    server_name sillytavern.example.com;

    client_max_body_size 1m;
    client_body_timeout 10s;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}