CVE-2026-108545 Details

A denial-of-service vulnerability has been identified in SillyTavern versions 1.12.13 through 1.19.0. This vulnerability allows unauthenticated remote attackers to exhaust server resources because the body-parser middleware processes request bodies before any authentication or whitelist checks are applied. Attackers can send large or compressed JSON or urlencoded bodies, up to 500 MB, either sequentially or in parallel, to deplete memory and CPU resources, causing a denial of service.

The vulnerability can be remediated by lowering the global body parser limit to a more reasonable size, such as 1 MB, and by registering authentication and whitelist checks before the body parsers in the middleware stack. Additionally, response compression should be disabled or managed carefully to prevent exploitation.