CVE-2026-49250

Conform, a type-safe form validation library for React-based applications, contains an algorithmic-complexity flaw (CWE-407) in the experimental parseSubmission API in packages/conform-dom/formdata.ts. For each unique field name in a submission, the parser rescans all FormData or URLSearchParams entries, so a form containing many unique field names triggers quadratic synchronous CPU work and can exhaust the event loop. An unauthenticated attacker who can reach any endpoint that passes attacker-controlled submission data to parseSubmission gains a cheap remote denial-of-service against the application, with no impact on confidentiality or integrity. All versions from 1.8.0 up to (but not including) 1.19.4 are affected, and the issue is fixed in version 1.19.4. No public proof-of-concept exists and the CVE is not in the CISA KEV catalog, so exploitation status is none known.

What to do: Upgrade conform (and conform-dom) to version 1.19.4 or later, which fixes the repeated-scan behavior. Until upgraded, keep enforcing request parsing limits before any Conform call — cap request body size, the number of FormData/URLSearchParams entries, and unique field names, and reject oversized submissions at the edge (proxy, framework body-parser limits). Audit whether any public route feeds unvalidated request data into parseSubmission and monitor server CPU/event-loop latency for anomalous spikes from form submissions.