16 matches found
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method. An attacker can supply a crafted PDF with a FlateDecode stream containing a decompression bomb, causing a small compressed file to decompress to hundreds of megabytes. ...
CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
@appsafetyhub/generator (>=1.1.18, <=1.1.19), @aswar-new-pdf-builder/common (>=0.0.1, <=0.1.0) +34 more potentially affected by CVE-2026-82864 via @pdfme/pdf-lib (1.18.4)
@pdfme/pdf-lib NPM version 1.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/pdf-lib and may be impacted: - @appsafetyhub/generator =1.1.18, =0.0.1, =0.0.3, =0.0.2, =1.0.0, =1.3.0, =1.0.1, =0.0.0, =0.0.0, =0.0.0, =3.0.0-beta.1, =1.1.10,...
EUVD-2026-68399
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
PT-2026-83741
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
CVE-2026-82864: Improper Handling of Highly Compressed Data (Data Amplification)
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...
Malicious code in pdf-lib-enhanced (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f666f9074e4d180ff635e06498918c71189395e3f8fd56a177767145022d76f Package name pdf-lib-enhanced mimics the widely-used pdf-lib library and ships a verbatim copy of upstream's README. package.json declares...
MAL-2026-4799 Malicious code in pdf-lib-enhanced (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f666f9074e4d180ff635e06498918c71189395e3f8fd56a177767145022d76f Package name pdf-lib-enhanced mimics the widely-used pdf-lib library and ships a verbatim copy of upstream's README. package.json declares...
Malicious Package
Overview pdf-lib-enhanced is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in pdf-lib-enhanced
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview @pdfme/pdf-lib is a Create and modify PDF files with JavaScript Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ensureBuffer function in the stream decoding. An attacker can exhaust system memory and cause...
PT-2026-29175
Summary The DecodeStream.ensureBuffer method in @pdfme/pdf-lib doubles its internal buffer without any upper bound on the decompressed size. A crafted PDF containing a FlateDecode stream with a high compression ratio decompression bomb causes unbounded memory allocation during stream decoding,...