Executive brief
pdfmake is a JavaScript library used to generate PDF documents in Node.js applications. A server-side request forgery (SSRF) vulnerability in the URL resolver component allows remote attackers to make unauthorized requests to internal systems or retrieve sensitive information by manipulating URL inputs, potentially exposing configuration data or internal services.
Technical details
A server-side request forgery (SSRF) vulnerability exists in pdfmake's src/URLResolver.js component affecting versions 0.3.0-beta.2 through 0.3.5. The vulnerability allows remote attackers to supply arbitrary URLs that the server will resolve and access, potentially reaching internal systems or sensitive endpoints. The attack requires no authentication and is network-accessible. An attacker can obtain sensitive information by crafting malicious URLs during PDF generation requests. The vulnerability was patched in version 0.3.6 with the introduction of the setUrlAccessPolicy() method, enabling server operators to implement URL access controls.
Affected products
- pdfmake pdfmake 0.3.0-beta.2 through 0.3.5
Timeline
- 2026-03-10: disclosed: Vulnerability published
- 2026-03-10: patched: Fix released in version 0.3.6 with setUrlAccessPolicy() method