ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. Impact Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream...