GitHub Advisoryadvisory · npm

GHSA-wp52-r2fp-4vmr pdfmake is vulnerable to server-side request forgery (SSRF)

HIGH Published 2026-03-10 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-26801
Ecosystem
npm
Packages
pdfmake
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2026-03-11

Affected packages

• npm pdfmake: >= 0.3.0-beta.2, < 0.3.6 → fixed in 0.3.6

Description

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

Related

Alias · CVE (1)

  • CVE-2026-26801 Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References