Is CVE-2026-115729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115729 being exploited in the wild.

How severe is CVE-2026-115729?

Medium severity, with a CVSS score of 6.8, published 23 October 2026.

Which products and versions are affected?

PDFME @Pdfme/Common 5.5.10 to before 6.2.6.

How is CVE-2026-115729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115729?

Check whether you run PDFME @Pdfme/Common at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115729: @pdfme/common server-side request forgery in isUrlSafeToFetch

CVE-2026-115729 · Severity: medium · CVSS 6.8 · Published 2026-10-23

@pdfme/common is a JavaScript library used to generate PDF documents with templates. An incomplete security fix allows attackers to bypass URL validation in the getB64BasePdf function by using IPv4-mapped IPv6 addresses, localhost aliases, or other hostname variations, enabling them to read internal or cloud metadata responses embedded in generated documents.

Vendors: PDFME.

Quick answers

Is CVE-2026-115729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115729 being exploited in the wild.
How severe is CVE-2026-115729?: Medium severity, with a CVSS score of 6.8, published 23 October 2026.
Which products and versions are affected?: PDFME @Pdfme/Common 5.5.10 to before 6.2.6.
Is there a fix for CVE-2026-115729?: Yes: fixed in 6.2.6. Until then: Do not allow untrusted users to control the basePdf parameter in templates, or restrict template editing to fully trusted parties only.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-16", "note": "Fix commit"}, {"kind": "advisory", "at": "2026-10-16", "note": "GitHub Security Advisory GHSA-2rg9-wxfw-wrr7"}, {"kind": "other", "at": "2026-10-23", "note": "CVE-2026-115729 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115729?: Check whether you run PDFME @Pdfme/Common at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.2.6

Do not allow untrusted users to control the basePdf parameter in templates, or restrict template editing to fully trusted parties only.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-16", "note": "Fix commit"}, {"kind": "advisory", "at": "2026-10-16", "note": "GitHub Security Advisory GHSA-2rg9-wxfw-wrr7"}, {"kind": "other", "at": "2026-10-23", "note": "CVE-2026-115729 published"}]

Technical details

The isUrlSafeToFetch function uses a denylist check on WHATWG URL-normalized hostnames to prevent server-side request forgery, but it fails to block IPv4-mapped IPv6 notation (e.g., [::ffff:127.0.0.1]), [::] loopback, NAT64 addresses, and trailing-dot hostname variations that all resolve to restricted internal addresses. An attacker who controls the basePdf parameter in a template can craft these alternative hostname forms to bypass the denylist and trigger fetches to loopback interfaces (127.0.0.1, localhost) or cloud metadata endpoints (169.254.169.254), with responses embedded in generated PDFs.

Affected products

pdfme @pdfme/common 5.5.10 to before 6.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.