Is CVE-2026-82864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82864 being exploited in the wild.

How severe is CVE-2026-82864?

Medium severity, with a CVSS score of 6.5, published 31 August 2026.

Which products and versions are affected?

@pdfme/pdf-lib (npm) SEMVER:introduced=0,fixed=5.5.10; PDFME @Pdfme/Generator affected through @pdfme/pdf-lib dependency; PDFME @Pdfme/Ui affected through @pdfme/pdf-lib dependency.

Is there a fix for CVE-2026-82864?

Yes. @pdfme/pdf-lib (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82864 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82864?

Check whether you run @pdfme/pdf-lib (npm), PDFME @Pdfme/Generator or PDFME @Pdfme/Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82864: PDFME decompression bomb in FlateDecode stream parsing

CVE-2026-82864 · Severity: medium · CVSS 6.5 · Published 2026-08-31

PDFME is a JavaScript library for PDF template generation and form handling used in both server-side and browser applications. An attacker can craft a malicious PDF with highly compressed (decompression bomb) FlateDecode streams that cause unbounded memory allocation when the library parses the PDF, leading to out-of-memory crashes and denial of service. A ~100KB compressed file can expand to >100MB during decompression, affecting both PDF generators and UI components that accept user-supplied templates.

Vendors: npm, PDFME.

Quick answers

Is CVE-2026-82864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82864 being exploited in the wild.
How severe is CVE-2026-82864?: Medium severity, with a CVSS score of 6.5, published 31 August 2026.
Which products and versions are affected?: @pdfme/pdf-lib (npm) SEMVER:introduced=0,fixed=5.5.10; PDFME @Pdfme/Generator affected through @pdfme/pdf-lib dependency; PDFME @Pdfme/Ui affected through @pdfme/pdf-lib dependency.
Is there a fix for CVE-2026-82864?: Yes. @pdfme/pdf-lib (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82864 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82864?: Check whether you run @pdfme/pdf-lib (npm), PDFME @Pdfme/Generator or PDFME @Pdfme/Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@pdfme/pdf-lib (npm): upgrade to 5.5.10 or later
```
npm install @pdfme/pdf-lib@5.5.10
```

Technical details

The vulnerability is a decompression bomb (zip bomb variant) caused by unbounded buffer growth in the DecodeStream.ensureBuffer() method. The method doubles its internal buffer size in a loop with no upper limit when decompressing FlateDecode streams. The vulnerable code path exists in packages/pdf-lib/src/core/streams/DecodeStream.ts:148-160, where size *= 2 continues indefinitely until memory exhaustion. An attacker-supplied PDF is loaded via the basePdf parameter in @pdfme/generator and @pdfme/ui, triggering full decompression through FlateStream → DecodeStream without size restrictions. The attack requires only the ability to supply a PDF template input and causes memory exhaustion in both Node.js server processes and browser tabs. Patches are available in version 5.5.10 and later.

Affected products

PDFME @pdfme/pdf-lib <=5.5.9
PDFME @pdfme/generator affected through @pdfme/pdf-lib dependency
PDFME @pdfme/ui affected through @pdfme/pdf-lib dependency

Identifiers

CVE-2026-82864
GHSA-vrqm-gvq7-rrwh

Timeline

2026-03-20: disclosed: Vulnerability published on GitHub Advisory Database
2026-03-20: patched: Patched in @pdfme/pdf-lib version 5.5.10 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.