Pdf Lib
Monthly
Memory exhaustion denial of service in @pdfme/pdf-lib before 5.5.10 allows network-accessible attackers with low-privilege PDF upload access to crash Node.js server processes or freeze browser tabs by submitting a crafted PDF embedding a FlateDecode decompression bomb. The DecodeStream.ensureBuffer() method doubles its internal buffer without any upper-bound check, enabling a kilobyte-scale compressed payload to trigger unbounded memory allocation during parsing. No active exploitation is confirmed in CISA KEV, but the GHSA advisory for GHSA-vrqm-gvq7-rrwh includes a proof-of-concept Python script that lowers the exploitation barrier.
Memory exhaustion denial of service in @pdfme/pdf-lib before 5.5.10 allows network-accessible attackers with low-privilege PDF upload access to crash Node.js server processes or freeze browser tabs by submitting a crafted PDF embedding a FlateDecode decompression bomb. The DecodeStream.ensureBuffer() method doubles its internal buffer without any upper-bound check, enabling a kilobyte-scale compressed payload to trigger unbounded memory allocation during parsing. No active exploitation is confirmed in CISA KEV, but the GHSA advisory for GHSA-vrqm-gvq7-rrwh includes a proof-of-concept Python script that lowers the exploitation barrier.