pdfmake
CVE-2025-11362
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication if user-controlled URLs reach the renderer; impact is pure availability denial with no confidentiality or integrity effect.
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
3DescriptionCVE.org
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
AnalysisAI
Unbounded HTTP redirect following in pdfmake's URLResolver crashes Node.js processes when attacker-controlled URLs trigger infinite redirect chains during file embedding. Affected are all 0.3.0 beta releases from beta.1 through beta.16 on both the npm and Java WebJars distributions. No special conditions beyond reaching a pdfmake rendering endpoint that accepts user-influenced document definitions are required; no public exploit code exists and the vulnerability is not in the CISA KEV catalog, but the attack mechanism is trivially reproducible.
Technical ContextAI
pdfmake is a client/server-side PDF generation library for Node.js (and browser environments), also distributed via WebJars for Java projects. The vulnerable component is src/URLResolver.js, which fetches remote assets - images, fonts, and other embeddable files - referenced in PDF document definitions. The fetchUrl() function recursively called itself on HTTP 3xx Location headers with no depth counter, meaning a redirect chain of arbitrary length would be followed until the process exhausted stack frames or file descriptors. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) flaw: the resource consumed is call-stack depth and concurrent HTTP connections. The fix in commit 741169634bf introduces a MAX_REDIRECTS constant of 30 and a redirectCount parameter, rejecting chains that exceed the cap. CPE strings confirm affected scope: cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta1 through cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16.
RemediationAI
Upgrade pdfmake to 0.3.0-beta.17 or a later release, which caps redirect chains at 30 hops in URLResolver.js via the MAX_REDIRECTS constant introduced in commit 741169634bf07730e010cd77477b6cc038e846ed. Note that a tagged npm package for 0.3.0-beta.17 is asserted by the advisory but not independently confirmed as published from the available reference data - verify availability on the npm registry before upgrading. If an immediate upgrade is not possible, apply input validation to allowlist or sanitize remote URLs before passing document definitions to pdfmake, preventing attacker-controlled redirect-loop servers from being reached. Alternatively, restrict outbound HTTP from the PDF rendering service at the network layer (firewall or egress proxy) to block connections to untrusted hosts entirely, which eliminates the redirect-follow path; this trades functionality (no remote asset embedding) for protection. For Java WebJars users, apply the equivalent version update tracked in SNYK-JAVA-ORGWEBJARSNPM-14101887.
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf
pdfmake is an open source client/server side PDF printing in pure JavaScript. Rated critical severity (CVSS 9.8), this v
pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver compo
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today