The @conform-to/dom parseSubmission API suffers from a CPU exhaustion vulnerability when parsing submissions with many unique form field names. The original implementation performed repeated lookups by field name, leading to excessive CPU consumption under crafted inputs. The patch replaces this with direct iteration over submitted entries, eliminating the repeated scans. This vulnerability affects versions >=1.8.0 and <1.19.4. Additional mitigation includes enforcing request parsing limits such as maxParts and maxTotalSize, especially for multipart requests, using tools like @remix-run/form-data-parser.

An attacker can cause excessive CPU usage on servers processing untrusted form submissions with many unique field names, potentially leading to denial of service due to resource exhaustion. There is no indication of privilege escalation or data compromise. The impact is limited to high CPU consumption affecting availability.

A patch is available and should be applied by upgrading @conform-to/dom to version 1.19.4 or later. Additionally, applications should enforce request parsing limits (e.g., maxParts, maxTotalSize) before passing data to Conform to reduce risk from maliciously crafted submissions. For multipart requests, use @remix-run/form-data-parser with appropriate limits configured.