SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources… (CVE-2026-108545)

The vulnerability in SillyTavern 1.12.13 through 1.19.0 arises because the body-parser middleware processes incoming request bodies before authentication and whitelist validation occur. Attackers can exploit this by sending very large or compressed JSON or urlencoded request bodies, up to 500 MB, optionally in parallel, which can exhaust server memory and CPU resources. This leads to a denial of service condition. The CVSS 3.1 score is 5.9, indicating a high severity denial of service impact without confidentiality or integrity impact.

Unauthenticated remote attackers can cause a denial of service by exhausting server memory and CPU resources through large or compressed request bodies. This results in service unavailability but does not affect confidentiality or integrity of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as limiting request body size and rate limiting to mitigate exploitation risk.