CVE-2026-49250: Conform Form Validation Library DoS Vulnerability

CVE-2026-49250 Overview

CVE-2026-49250 is a denial-of-service vulnerability in Conform, a type-safe form validation library for TypeScript and JavaScript applications. The flaw affects the parseSubmission future API in packages/conform-dom/formdata.ts and impacts versions from 1.8.0 up to but not including 1.19.4. The function repeatedly scans FormData or URLSearchParams entries for each unique field name, producing algorithmic complexity issues [CWE-407]. An unauthenticated remote attacker can submit a crafted form containing many unique field names to trigger excessive synchronous CPU work, blocking the event loop and denying service to legitimate users.

Critical Impact
Unauthenticated attackers can exhaust CPU resources on any application that passes untrusted submissions to parseSubmission, resulting in service unavailability.

Affected Products

Conform (@conform-to/dom) versions 1.8.0 through 1.19.3
Applications using the parseSubmission future API in packages/conform-dom/formdata.ts
Web applications that pass unfiltered FormData or URLSearchParams submissions to Conform

Discovery Timeline

2026-09-14 - CVE-2026-49250 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-49250

Vulnerability Analysis

The vulnerability resides in the submission parsing logic of Conform's DOM package. The original implementation iterated over new Set(formData.keys()) and, for each unique name, called formData.getAll(name). Each getAll invocation performs a full linear scan of the underlying entries. When the number of unique field names grows large, the total work becomes quadratic in the number of entries.

An attacker crafting a submission with thousands of distinct field names forces the server to perform repeated full scans synchronously. This blocks the Node.js event loop, stalls request handling, and can render the application unresponsive. The library documentation notes that applications should enforce request parsing limits before invoking Conform, but many deployments do not implement such controls at the framework layer.

Root Cause

The root cause is inefficient algorithmic handling of submission entries. Using formData.getAll(name) inside a loop over unique names produces O(n²) behavior with respect to entry count. This maps to [CWE-407] Inefficient Algorithmic Complexity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single HTTP POST containing a multipart form or URL-encoded body with a large number of unique keys. The vulnerable endpoint invokes parseSubmission, which then consumes CPU proportional to the square of the input size.

typescript

// Patch excerpt from packages/conform-dom/formdata.ts
// Source: https://github.com/edmundhung/conform/commit/f9a1e696ef950efcada5f06ea2b202da505bf9b0

-	for (const name of new Set(formData.keys())) {
-		if (name !== intentName && !options?.skipEntry?.(name)) {
-			let value: FormDataEntryValue | FormDataEntryValue[] | undefined =
-				formData.getAll(name);
-			const segments = parsePath(name);
-
-			// If the name ends with [], remove the empty segment and keep the full array
-			// Otherwise, unwrap single values
-			if (segments.length > 0 && segments[segments.length - 1] === '') {
-				segments.pop();
+	const segmentsByName = new Map<string, Array<string | number> | null>();
+	const stripEmptyValues = options?.stripEmptyValues ?? false;
+	let intentValue: string | null | undefined = undefined;
+
+	for (const [name, entryValue] of formData) {
+		if (name === intentName) {
+			if (intentValue === undefined) {
+				intentValue = typeof entryValue === 'string' ? entryValue : null;
+			}
+
+			continue;
+		}
+
+		let segments = segmentsByName.get(name);
+		let isArrayField = segments != null;
+
+		// If segments are not cached for this name, parse and cache them

The fix replaces the nested scan pattern with a single pass over formData entries, caching parsed segments in a Map keyed by field name. This reduces the complexity to linear time.

Detection Methods for CVE-2026-49250

Indicators of Compromise

HTTP POST requests with abnormally large numbers of unique form field names in a single body
Sustained high CPU utilization on Node.js worker processes correlated with form submission endpoints
Increased request latency or timeouts on endpoints backed by Conform's parseSubmission
Application logs showing event loop lag spikes during submission processing

Detection Strategies

Instrument application middleware to log the count of unique field names per submission and alert on outliers
Deploy web application firewall (WAF) rules that inspect request body cardinality and reject requests exceeding a defined key threshold
Use runtime performance monitoring to identify long synchronous tasks originating from parseSubmission call sites
Review dependency manifests (package.json, lockfiles) for @conform-to/* packages at versions between 1.8.0 and 1.19.3

Monitoring Recommendations

Track event loop lag metrics for Node.js services processing user-submitted forms
Monitor upstream reverse proxy logs for repeated large POST bodies from single source IPs
Alert on rate-of-change increases in 4xx/5xx responses tied to form submission routes

How to Mitigate CVE-2026-49250

Immediate Actions Required

Upgrade Conform to version 1.19.4 or later across all affected applications
Audit application entry points that invoke parseSubmission and confirm request parsing limits are enforced upstream
Configure body-parser or framework-level limits on the maximum number of form fields and total body size
Add rate limiting on endpoints that accept form submissions from unauthenticated clients

Patch Information

The issue is fixed in Conform version 1.19.4. The remediation is described in GitHub Security Advisory GHSA-525m-7f82-2mf7 and released in GitHub Release v1.19.4. The underlying code change is available in the GitHub Commit Update, which replaces per-name getAll scans with a single-pass iteration and cached segment map.

Workarounds

Enforce a strict maximum on the number of form fields accepted by the framework before invoking Conform
Reject requests exceeding a conservative body size limit at the reverse proxy or WAF layer
Require authentication on form-processing endpoints where feasible, reducing exposure to unauthenticated abuse

bash

# Upgrade Conform to the patched release
npm install @conform-to/dom@^1.19.4 @conform-to/react@^1.19.4

# Verify installed version
npm ls @conform-to/dom