Executive brief
@conform-to/dom is a React library for building forms with web standards. The parseSubmission function is vulnerable to CPU exhaustion when processing form submissions with many unique field names. An attacker can craft a malicious form submission to cause excessive CPU consumption, effectively denying service to legitimate users of applications using the vulnerable library.
Technical details
The vulnerability is a classic algorithmic complexity issue (CWE-407) in the parseSubmission future API. The root cause is that the parser previously looked up form field values by name using an inefficient approach that required repeated scans of the submitted entries. When an attacker supplies FormData or URLSearchParams with many unique field names, each lookup operation scans through the entire set of entries, resulting in O(n²) worst-case behavior and excessive synchronous CPU work. The attack is network-accessible, requires no privileges or user interaction, and can be triggered by sending a malicious form submission. The fix, released in version 1.19.4, iterates submitted entries directly instead of repeatedly looking up values by field name. Applications should also enforce request parsing limits before passing untrusted data to Conform, using mechanisms like maxParts and maxTotalSize in multipart form parsers.
Affected products
- Edmund Hung @conform-to/dom >=1.8.0, <1.19.4
Timeline
- 2026-07-02: disclosed: Vulnerability disclosed via GHSA-525m-7f82-2mf7
- 2026-07-02: patched: Fix released in version 1.19.4