CVE-2026-49250

Executive Summary

CVE-2026-49250 is a denial-of-service vulnerability in Conform, a type-safe form validation library, affecting versions 1.8.0 through 1.19.3. The parseSubmission API in packages/conform-dom/formdata.ts performs repeated synchronous scans of FormData or URLSearchParams entries for each unique field name, causing excessive CPU consumption when an attacker submits a crafted form containing many unique field names. Applications that pass user submissions directly to parseSubmission without enforcing request parsing limits are vulnerable to unauthenticated denial of service, fixed in version 1.19.4.

Technical Analysis

Conform is a form validation library that supports parsing nested objects using dot-notation (object.property). The vulnerable component is the parseSubmission future API located in packages/conform-dom/formdata.ts. The mechanism of the flaw is an algorithmic complexity issue (CWE-407): the function repeatedly scans the full set of FormData or URLSearchParams entries for each unique field name present in the submission.

When a legitimate form is submitted, the number of unique field names is bounded by the form's schema, so the repeated scanning remains cheap. An attacker can bypass that natural bound by submitting a crafted form containing many unique field names. Because the library scans the entire entry collection once per unique name, the work performed scales in a super-linear fashion with respect to the number of attacker-controlled field names. The result is excessive synchronous CPU work on the server that processes the submission.

The attack surface is any application endpoint that accepts form submissions (or URLSearchParams-encoded data) and forwards them to Conform's parseSubmission. The vulnerability is reachable without authentication because form submission endpoints are typically public. Exploitation does not require a memory-corruption primitive, injection payload, or authentication — only the ability to send a form body with a large number of distinct field names.

Two properties make this class of vulnerability operationally significant:

1. Synchronous execution. The excessive work occurs synchronously within the request handler, blocking the Node.js event loop (or equivalent single-threaded runtime). A small number of concurrent malicious requests can therefore starve legitimate traffic rather than merely consuming a bounded quantity of CPU.
2. No inherent input-size bound in the library. The description explicitly notes that applications "should continue to enforce request parsing limits before invoking Conform," indicating the library itself does not impose a sufficient limit on the number of unique field names.

The fix in version 1.19.4 addresses the repeated-scan behavior so that parsing cost does not scale with unbounded attacker-controlled field names. No public proof-of-concept, exploit code, or Nuclei template is available as of this writing; the mechanism is inferred from the NVD description and the algorithmic nature of the defect. Insufficient technical detail is available to describe specific internal data structures or complexity classes beyond what the description states.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (algorithmic complexity / resource exhaustion) and the NVD description.

Step 1 — Reconnaissance / target identification. The attacker identifies an application that uses Conform (a JavaScript/TypeScript form validation library) and exposes a public form-submission endpoint that forwards data to parseSubmission. Fingerprinting may rely on client-side bundle artifacts referencing Conform, response behavior of form endpoints, or public source disclosure. No specific URL path can be asserted, because none is given in the source data.

Step 2 — Triggering the specific flaw class. The attacker constructs an HTTP request whose body contains a deliberately large number of unique field names (in FormData or URLSearchParams form encoding), including nested-style names using dot-notation such as object.property. The critical property is uniqueness: each distinct name causes the vulnerable routine to rescan the entry collection.

Step 3 — Payload/execution method (vulnerability-class level). The request is sent to the form-submission endpoint. The application passes the body to parseSubmission, which performs excessive synchronous CPU work proportional to the number of unique field names. Because the work is synchronous, the request handler blocks; repeated or concurrent requests multiply the effect.

Step 4 — Post-exploitation impact. Successful exploitation results in denial of service: degraded response times, event-loop starvation, request queue buildup, and potential unavailability of the affected application. There is no evidence in the provided data of confidentiality or integrity impact, no remote code execution, and no lateral movement. The attacker can sustain the condition by continuously resending crafted submissions.

Impact Assessment

The impact is availability-only. Using the assigned vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the relevant subscores are:

• Attack Vector (Network): exploitable remotely over the network.
• Attack Complexity (Low): no specialized conditions beyond reaching a form endpoint that uses parseSubmission.
• Privileges Required (None): unauthenticated, as stated in the description.
• User Interaction (None): the attacker submits the request directly; no victim action is required.
• Scope (Unchanged): impact is confined to the vulnerable application.
• Confidentiality (None) / Integrity (None): no data disclosure or tampering is described.
• Availability (High): excessive synchronous CPU work can render the application unresponsive.

Affected systems: any Node.js (or equivalent runtime) application using Conform 1.8.0 through 1.19.3 that exposes form submissions to parseSubmission without upstream request limits.

Blast radius: a publicly reachable, unauthenticated form endpoint that is single-threaded and shares a process across many routes can degrade the entire application, not just the form functionality. Multi-tenant or shared-runtime deployments risk cross-tenant availability impact. EPSS is 0.00514 (41.6th percentile), indicating low but non-trivial predicted exploitation likelihood; the vulnerability is not listed in CISA KEV, and no exploit-in-the-wild evidence is provided.

Detection Guidance

Sigma Rule

title: Potential Conform parseSubmission Denial of Service via Many Unique Form Fields
id: 8f3c1a2e-7b64-4d19-9c2a-conform49250
status: experimental
description: Detects HTTP form submissions with an abnormally high number of unique field names targeting applications using Conform parseSubmission (CVE-2026-49250).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-49250
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_contenttype:
    cs-Content-Type|contains:
      - 'application/x-www-form-urlencoded'
      - 'multipart/form-data'
  selection_fieldcount:
    cs-uri-query|re: '(&[^=&]+=){50,}'
  condition: selection_method and selection_contenttype and selection_fieldcount
falsepositives:
  - Legitimate bulk or batch forms with many fields
  - Automated integration tests
level: medium
tags:
  - attack.t1499
  - cve.2026.49250

YARA Rule

rule CVE_2026_49250_Conform_ParseSubmission_DoS
{
    meta:
        description = "Detects artifacts referencing Conform parseSubmission vulnerable code paths (CVE-2026-49250)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49250"
        date = "2026-01-01"
    strings:
        $s1 = "parseSubmission" ascii wide
        $s2 = "packages/conform-dom/formdata.ts" ascii
        $s3 = "conform-dom" ascii wide
    condition:
        any of ($s*) and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-49250 Conform parseSubmission Potential DoS - Excessive Unique Form Fields"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/x-www-form-urlencoded"; pcre:"/(&[^=&]+=){50,}/U"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-49250; sid:2026492501; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "POST"
      and http.request.body.content : "application/x-www-form-urlencoded"
      and length(http.request.body.content) > 2000 ]
  [ network where http.request.method == "POST" ]

Splunk SPL Query

index=web sourcetype=access_combined method=POST
| eval field_count = mvcount(split(uri_query, "&"))
| where field_count > 50 OR len(form_body) > 2000
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-49250,">
  <rule id="100250" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="url.query" type="pcre2">(&amp;[^=&amp;]+=){50,}</field>
    <description>CVE-2026-49250: Possible Conform parseSubmission DoS via excessive unique form fields from $(srcip)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_49250,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations (before patching):

   • Enforce request parsing limits upstream of Conform, as the advisory explicitly recommends, including a cap on the total number of form fields and a maximum body size at the reverse proxy/WAF layer.
   • Rate-limit form-submission endpoints per source IP to constrain the number of concurrent malicious submissions reaching parseSubmission.
   • Where feasible, disable or restrict public access to endpoints that forward untrusted data directly into parseSubmission until upgraded.

2. Patch/upgrade steps:

   • Upgrade Conform to version 1.19.4, which fixes the issue (per the OSV-sourced advisory; only a single source claims the patch, so validate the fixed version in your dependency registry before deployment).
   • Rebuild and redeploy affected applications; verify the resolved Conform version in lockfiles and build artifacts.

3. Long-term hardening:

   • Add automated dependency scanning and alerting for advisories affecting Conform.
   • Treat all user-supplied form data as untrusted and enforce structural limits (field count, nesting depth, body size) by design in the application tier.
   • Monitor for anomalous spikes in synchronous CPU usage or event-loop lag correlated with form-submission traffic.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49250
• OSV Advisory (patch source referenced): https://osv.dev/ (search CVE-2026-49250)
• CWE-407 — Inefficient Algorithmic Complexity: https://cwe.mitre.org/data/definitions/407.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog (CVE-2026-49250 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild activity are identified in the provided data. EPSS 0.00514 (41.6th percentile) suggests low near-term exploitation pressure; no public PoC, exploit code, or Nuclei template is available.