# CVE-2026-82864: PDFME decompression bomb in FlateDecode stream parsing

Source: https://junglewise.ai/threats/cve-2026-82864-pdfme-decompression-bomb-in-flatedecode-stream-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82864 · Severity: medium · CVSS 6.5 · Published 2026-08-31

PDFME is a JavaScript library for PDF template generation and form handling used in both server-side and browser applications. An attacker can craft a malicious PDF with highly compressed (decompression bomb) FlateDecode streams that cause unbounded memory allocation when the library parses the PDF, leading to out-of-memory crashes and denial of service. A ~100KB compressed file can expand to >100MB during decompression, affecting both PDF generators and UI components that accept user-supplied templates.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [PDFME](https://junglewise.ai/threats/vendors/pdfme).

## Quick answers

**Is CVE-2026-82864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82864 being exploited in the wild.

**How severe is CVE-2026-82864?** Medium severity, with a CVSS score of 6.5, published 31 August 2026.

**Which products and versions are affected?** @pdfme/pdf-lib (npm) SEMVER:introduced=0,fixed=5.5.10; PDFME @Pdfme/Generator affected through @pdfme/pdf-lib dependency; PDFME @Pdfme/Ui affected through @pdfme/pdf-lib dependency.

**Is there a fix for CVE-2026-82864?** Yes. @pdfme/pdf-lib (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82864 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82864?** Check whether you run @pdfme/pdf-lib (npm), PDFME @Pdfme/Generator or PDFME @Pdfme/Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @pdfme/pdf-lib (npm): upgrade to 5.5.10 or later

  ```sh
  npm install @pdfme/pdf-lib@5.5.10
  ```


## Technical details

The vulnerability is a decompression bomb (zip bomb variant) caused by unbounded buffer growth in the DecodeStream.ensureBuffer() method. The method doubles its internal buffer size in a loop with no upper limit when decompressing FlateDecode streams. The vulnerable code path exists in packages/pdf-lib/src/core/streams/DecodeStream.ts:148-160, where size *= 2 continues indefinitely until memory exhaustion. An attacker-supplied PDF is loaded via the basePdf parameter in @pdfme/generator and @pdfme/ui, triggering full decompression through FlateStream → DecodeStream without size restrictions. The attack requires only the ability to supply a PDF template input and causes memory exhaustion in both Node.js server processes and browser tabs. Patches are available in version 5.5.10 and later.

## Affected products

- PDFME @pdfme/pdf-lib <=5.5.9
- PDFME @pdfme/generator affected through @pdfme/pdf-lib dependency
- PDFME @pdfme/ui affected through @pdfme/pdf-lib dependency

## Identifiers

- CVE-2026-82864
- GHSA-vrqm-gvq7-rrwh

## Timeline

- 2026-03-20: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-03-20: patched: Patched in @pdfme/pdf-lib version 5.5.10 and later

## References

- [https://github.com/pdfme/pdfme/security/advisories/GHSA-vrqm-gvq7-rrwh](https://github.com/pdfme/pdfme/security/advisories/GHSA-vrqm-gvq7-rrwh)
- [https://github.com/pdfme/pdfme](https://github.com/pdfme/pdfme)