CVE-2025-11362
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input.
Risk Assessment
Risk of application crash or unresponsiveness (DoS) through exploitation, potentially leading to service disruption.
Recommendation
Upgrade the pdfmake package to version 0.3.0-beta.17 or later, which fixes this vulnerability.
Other vulnerabilities in pdfmake
See all- CVE-2026-26801High
A Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component.
- CVE-2026-114491Medium
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Original NVD description (English source)
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS