Approved changes feed: RSS · Atom
cpe:2.3:a:edmundhung:conform:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Edmundhung (08946c9d-aec5-5429-b6c0-feb633db9180) |
|---|---|
| Product | Conform (a3922380-c3c9-55cd-ba8a-f2d7f18e14b5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49250 |
vulnerable | 2026-09-16 04:32:55.624980 |
Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service in an application that passes the submission to parseSubmission. Applications should continue to enforce request parsing limits before invoking Conform. This issue is fixed in version 1.19.4.
Published: 2026-09-14T17:14:08.702Z
Updated: 2026-09-14T19:01:26.926Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32866 |
vulnerable | 2026-06-08 06:37:24.604788 |
Conform contains Prototype Pollution Vulnerability in `parseWith...` function
HIGH (8.6)
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.
Published: 2024-04-23T21:07:06.216Z
Updated: 2024-08-02T02:20:35.639Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.