What is the CVSS score of CVE-2026-26801?

CVE-2026-26801 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pdfmake are affected by CVE-2026-26801?

A critical SSRF vulnerability in pdfmake affects organizations using versions 0.3.0-beta.2 through 0.3.5, potentially allowing attackers to access sensitive internal resources and data through…. A patch is available.

How to fix or mitigate CVE-2026-26801?

Within 24 hours: Identify all applications and services using pdfmake and document their version numbers and deployment scope. Within 7 days: Implement network segmentation to restrict outbound connections from PDF generation services and deploy WAF rules to block suspicious URL patterns in PDF requests. Within 30 days: Upgrade all affected instances to pdfmake version 0.3.6 or later, configure setUrlAccessPolicy() to whitelist only necessary domains, and conduct security testing to validate the fix.

Pdfmake CVE-2026-26801

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-10 cve@mitre.org

GHSA-wp52-r2fp-4vmr

SSRF Pdfmake

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 19:17 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on pdfmake (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.3.0-beta.2.

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

AnalysisAI

pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver component that allows unauthenticated remote attackers to access sensitive information through crafted URL requests. Affected applications using vulnerable versions without proper URL access controls are at risk of information disclosure. No patch is currently available, though version 0.3.6 introduces URL access policy controls to mitigate the risk.

Technical ContextAI

This vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affects vulnerability in pdfmake versions 0.3.0-beta.2. Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.