CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
Unauthenticated attackers can cause denial of service in SillyTavern by sending large payloads before authentication checks occur.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108545?
CVE-2026-108545 is a high-severity denial of service vulnerability in SillyTavern, published on 10 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
Weakness: CWE-400
Which versions are affected by CVE-2026-108545?
How do I fix CVE-2026-108545?
No fix has been published for CVE-2026-108545 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-108545 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108545 exists.
Sources
Also known as GHSA-g54j-r2jq-rm6q.