The vulnerability in @conform-to/dom's parseSubmission API allows CPU exhaustion when parsing submissions with many unique field names. The original implementation performed repeated lookups by field name, leading to excessive CPU consumption. The fix involves iterating directly over submitted entries instead of repeated lookups. This vulnerability affects versions >=1.8.0 and <1.19.4. No known exploits are reported in the wild. Additional mitigation can be achieved by enforcing request parsing limits using tools like @remix-run/form-data-parser.

An attacker can cause high CPU usage on systems using vulnerable versions of @conform-to/dom by submitting form data with many unique field names, potentially leading to denial of service due to resource exhaustion. There is no indication of privilege escalation, data leakage, or other impacts beyond CPU exhaustion.

Upgrade to version 1.19.4 or later of @conform-to/dom where the vulnerability is fixed. Additionally, enforce request parsing limits on untrusted form submissions before passing data to Conform. For multipart requests, use @remix-run/form-data-parser with options like maxParts, maxTotalSize, maxFileSize, maxFiles, and maxHeaderSize to limit resource consumption.