p PatchFirst

PatchFirst · Latest vulnerabilities

@pdfme/pdf-lib vulnerabilities

Vulnerabilities published for @pdfme/pdf-lib in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-82864

    High · CVSS 7.1EPSS 0.44%Fix available

    pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

    pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.

    @pdfme/pdf-libNode.js
    • Update to 5.5.10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →