CVE-2026-26801

High

Published: 10/03/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component.

Risk Assessment

Organizations may be at risk of data leakage if they do not implement appropriate URL access policies in applications using pdfmake.

Recommendation

It is recommended to upgrade to version 0.3.6 or later and configure URL access policies using the setUrlAccessPolicy() method.

Other vulnerabilities in pdfmake

CVE-2025-11362High
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.