CVE-2026-108545: SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it over the network. Authentication and whitelist checks occur after the affected body-parsing middleware, so they do not prevent the resource consumption.
What traffic is needed to trigger the denial of service?
An attacker can submit large or compressed JSON or URL-encoded request bodies of up to 500 MB. Parallel requests can increase memory and CPU exhaustion and make service denial more likely.
Which deployments are affected?
SillyTavern versions 1.12.13 through 1.19.0 are affected. The issue is in request processing before authentication, so any reachable instance in that version range should be considered exposed to unauthenticated request-based exhaustion.