CVE-2026-108545

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.

CVSS 4.0

8.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-25)

CWE

CWE-400

Published

2026-10-10

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

References

• https://github.com/SillyTavern/SillyTavern
• https://github.com/SillyTavern/SillyTavern/blob/1.19.0/src/server-main.js#L110-L150
• https://hackmd.io/@haind/sillytavern-preauth-body-parser-dos
• https://www.vulncheck.com/advisories/sillytavern-1.12.13-through-1.19.0-pre-authentication-denial-of-service-via-body-parsing

Check your stackJSON