SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser mid…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 10, 2026 · NIST NVD

   Detected

   SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.

2. Oct 14, 2026 · NIST NVD

   Updated

   SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.

Sources

• CVE.orgVulnerability recordCVE-2026-108545

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-108545

  30-day exploitation probability 0.6%

  first.org
• NIST NVDVulnerability recordCVE-2026-108545

  SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencode

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · hackmd.io
• Reference · vulncheck.com