Is CVE-2026-82866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82866 being exploited in the wild.

How severe is CVE-2026-82866?

Medium severity, with a CVSS score of 6.8, published 31 August 2026.

Which products and versions are affected?

@pdfme/common (npm) SEMVER:introduced=0,fixed=5.5.10.

Is there a fix for CVE-2026-82866?

Yes. @pdfme/common (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82866 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82866?

Check whether you run @pdfme/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82866: PDFME SSRF in getB64BasePdf via unvalidated URL fetch

CVE-2026-82866 · Severity: medium · CVSS 6.8 · Published 2026-08-31

PDFME is a popular open-source PDF generation library used in web applications. The library's PDF generation function can be forced to make network requests to attacker-specified URLs when processing user-supplied templates, potentially exposing cloud credentials, internal APIs, and network topology. This poses a critical risk for web services accepting user-provided PDF templates.

Vendors: npm.

Quick answers

Is CVE-2026-82866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82866 being exploited in the wild.
How severe is CVE-2026-82866?: Medium severity, with a CVSS score of 6.8, published 31 August 2026.
Which products and versions are affected?: @pdfme/common (npm) SEMVER:introduced=0,fixed=5.5.10.
Is there a fix for CVE-2026-82866?: Yes. @pdfme/common (npm): upgrade to 5.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82866 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82866?: Check whether you run @pdfme/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@pdfme/common (npm): upgrade to 5.5.10 or later
```
npm install @pdfme/common@5.5.10
```

Technical details

The vulnerability exists in the getB64BasePdf function in @pdfme/common (packages/common/src/helper.ts:130-141), which accepts a basePdf parameter and fetches arbitrary URLs via fetch() without any validation. When basePdf is a non-data-URI string and window is defined, the function passes it directly to fetch() with no URL allowlist, protocol restrictions, or private IP filtering. An attacker who can control the basePdf field in a template—either through a web application accepting user-supplied templates, or indirectly through template injection—can trigger SSRF attacks. Attack preconditions: the application must call generate() or related functions with attacker-controlled template data. The vulnerability affects SSR environments (Next.js, Nuxt, Cloudflare Workers) where window is polyfilled and fetch has unrestricted network access. Patches are available in version 5.5.10 and later.

Affected products

PDFME @pdfme/common <=5.5.9

Identifiers

CVE-2026-82866
GHSA-pgx6-7jcq-2qff

Timeline

2026-03-20: disclosed
2026-03-20: patched: Version 5.5.10 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.