CVE-2026-108545 in SillyTavern
Summary
by MITRE • 10/10/2026
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The identified vulnerability within SillyTavern versions 1.12.13 through 1.19.0 represents a critical architectural flaw in the application's request handling pipeline, specifically classified under CWE-787: Out-of-bounds Write and more accurately as CWE-400: Uncontrolled Resource Consumption. The core issue stems from the improper ordering of middleware execution within the Node.js-based web server framework. In this configuration, the body-parser middleware is initialized to process incoming HTTP request bodies before any authentication mechanisms or IP whitelist checks are invoked. This sequencing error creates a significant window of opportunity for unauthenticated remote attackers to exploit the system's resource allocation logic without needing valid credentials or authorized network access.
From an operational perspective, this flaw allows adversaries to launch denial-of-service attacks by sending maliciously crafted HTTP requests with excessively large payloads. The vulnerability specifically targets JSON and urlencoded body parsers, which are configured to accept data up to 500 MB in size. By submitting these oversized bodies, often utilizing compression techniques such as gzip or deflate to maximize the ratio of compressed input to decompressed memory usage, attackers can rapidly deplete server-side resources. The application must allocate substantial amounts of RAM and CPU cycles to parse, validate, and store these large data structures before it ever reaches the stage where it would reject the request due to lack of authentication. This process effectively ties up system threads and memory pools, rendering the service unavailable for legitimate users who are attempting to access the chat interface or API endpoints.
The attack vector is straightforward yet highly effective against infrastructure that does not implement strict rate limiting or payload size restrictions at the reverse proxy level prior to application processing. An attacker can initiate multiple parallel connections, each sending a large compressed body, thereby amplifying the resource exhaustion effect across all available worker threads. This behavior aligns with ATT&CK technique T1498: Network Denial of Service, where the adversary aims to disrupt availability by overwhelming target resources rather than compromising confidentiality or integrity. The lack of pre-authentication filtering means that even basic automated scanning tools can trigger this condition, potentially causing widespread outages for any deployment relying on SillyTavern as a primary interface for large language model interactions.
Mitigation strategies must address both the immediate configuration flaw and broader security hygiene practices. First and foremost, users should upgrade to a patched version of SillyTavern where the middleware order has been corrected to ensure authentication and whitelist checks occur before body parsing takes place. For deployments that cannot immediately patch, implementing reverse proxy configurations such as Nginx or Apache is essential. These proxies can be configured with strict limits on client_max_body_size or LimitRequestBody directives set to a reasonable threshold well below 500 MB, effectively truncating malicious payloads before they reach the Node.js application layer. Additionally enabling rate limiting at the network edge can prevent parallel connection floods that exacerbate resource exhaustion. Organizations should also monitor server metrics for unusual spikes in memory usage associated with HTTP POST requests from unauthenticated sources to detect potential exploitation attempts in real time.