Executive brief
pdfmake is a JavaScript library used to generate PDF documents programmatically. An attacker can exploit uncontrolled URL redirects in file embedding to cause the application to consume excessive resources and crash or become unresponsive, potentially disrupting PDF generation services for legitimate users.
Technical details
The vulnerability is an allocation of resources without limits issue (CWE-770) affecting pdfmake versions 0.3.0-beta.1 through 0.3.0-beta.16. When handling file embedding with URLs, the library fails to properly limit or throttle processing of repeatedly redirecting URLs. An attacker can supply crafted input containing chains of HTTP redirects to trigger uncontrolled resource consumption. This requires network-accessible file embedding functionality and occurs without requiring authentication or user interaction. The vulnerability was fixed in version 0.3.0-beta.17 via commit 741169634bf07730e010cd77477b6cc038e846ed.
Affected products
- pdfmake pdfmake 0.3.0-beta.1 to 0.3.0-beta.16
Timeline
- 2025-10-07: disclosed
- 2025-10-07: patched: Fixed in version 0.3.0-beta.17