pdfme pdf-lib CVE-2026-82864

The attacker must be able to supply a crafted PDF to the application - via a file upload form, an API parameter accepting base64-encoded PDF data, or a URL reference to an attacker-controlled PDF. The CVSS 4.0 PR:L rating indicates low-privilege authentication is sufficient; administrative access is not required. The vulnerability is triggered by any PDF containing a FlateDecode (DEFLATE/zlib) stream, which is a standard, commonly used PDF feature - no non-default configuration is required on the victim system. Exploitation is limited by the need for some form of authenticated or upload-capable access; purely static read-only deployments that never call PDFDocument.load() on user-supplied data are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) is internally consistent with the description: straightforward network-exploitable availability attack requiring only low privileges, with no confidentiality or integrity impact limiting blast radius to service disruption. The PR:L rating reflects that most real deployments expose PDF processing only to authenticated or registered users, which is a meaningful barrier. No EPSS score was supplied in the source data, and this CVE is absent from CISA KEV, so exploitation probability is unquantified - the advisory's inclusion of a proof-of-concept script materially lowers the effort required for opportunistic attack. The server-side impact (crashing the Node.js process) is the more operationally severe scenario, as a shared application server crash affects all concurrent users simultaneously, whereas the browser-side effect is scoped to a single tab. No conflicts were identified between the CVSS vector and the vulnerability description.

An attacker with a low-privilege account on a service that accepts user-submitted PDFs crafts a small (kilobyte-scale) compressed PDF containing a FlateDecode stream engineered for extreme compression ratio. Upon upload, the server invokes PDFDocument.load(), which triggers FlateStream decompression through the unbounded ensureBuffer() loop, rapidly exhausting process memory. The Node.js server process crashes, denying service to all concurrent users; a proof-of-concept Python script for constructing such a payload is included in GHSA-vrqm-gvq7-rrwh.