CVE-2026-26801: pdfmake Server-Side Request Forgery (SSRF) Vulnerability
Summary
CVE-2026-26801: pdfmake is vulnerable to server-side request forgery (SSRF). Affects pdfmake versions >= 0.3.0-beta.2, < 0.3.6. Fixed in 0.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdfmake is a popular JavaScript library used for generating PDF documents in web applications. It allows developers to create complex documents with ease, providing features such as tables, images, and styling options. However, certain versions of pdfmake are vulnerable to a Server-Side Request Forgery (SSRF) attack, which can expose sensitive information.
Vulnerability Detail
The SSRF vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 arises from the src/URLResolver.js component. This flaw allows remote attackers to manipulate server requests, potentially leading to unauthorized access to internal resources or sensitive data. The vulnerability is classified under CWE-918, indicating a weakness in the system's ability to validate requests properly.
How To Fix
Minimum fixed version
0.3.6
This is the first release that contains the fix.
npm install pdfmake@0.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing a URL access policy manually in your application to restrict access to sensitive endpoints. Ensure that your server validates and sanitizes all incoming requests to mitigate potential SSRF attacks.
Conclusion
The SSRF vulnerability in pdfmake poses a significant risk to applications using affected versions. It is crucial to update to version 0.3.6 or later to mitigate this risk effectively. Additionally, implementing proper URL access policies can help protect against potential attacks.
See every vulnerability recorded for pdfmake →
FAQ
SSRF is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive information.
The vulnerability affects pdfmake versions 0.3.0-beta.2 through 0.3.5.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Implement a URL access policy and ensure your server validates all incoming requests to mitigate the risk of SSRF attacks until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for pdfmake.
