CVE-2026-108545

EUVD-2026-96340
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
sillytavernsillytavern
1.12.13 ≤
𝑥
≤ 1.19.0
CNA
Common Weakness Enumeration
References
https://github.com/SillyTavern/SillyTavern
https://github.com/SillyTavern/SillyTavern/blob/1.19.0/src/server-main.js#L110-L150
https://hackmd.io/@haind/sillytavern-preauth-body-parser-dos
https://www.vulncheck.com/advisories/sillytavern-1.12.13-through-1.19.0-pre-authentication-denial-of-service-via-body-parsing