CVE-2026-26801
HighSummary
A Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component.
Risk Assessment
Organizations may be at risk of data leakage if they do not implement appropriate URL access policies in applications using pdfmake.
Recommendation
It is recommended to upgrade to version 0.3.6 or later and configure URL access policies using the setUrlAccessPolicy() method.
Other vulnerabilities in pdfmake
See all- CVE-2026-114491Medium
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
- CVE-2025-11362High
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS