CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.58% probability · 47th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Source
- disclosure@vulncheck.com
EPSS moved from 0.6% on 11 October 2026 to 0.6% on 26 October 2026.
References
- https://github.com/SillyTavern/SillyTavern
- https://github.com/SillyTavern/SillyTavern/blob/1.19.0/src/server-main.js#L110-L150
- https://hackmd.io/@haind/sillytavern-preauth-body-parser-dos
- https://www.vulncheck.com/advisories/sillytavern-1.12.13-through-1.19.0-pre-authentication-denial-of-service-via-body-parsing
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.