CVE-2026-102354: BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXYSECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BentoPDFto a version that resolves this vulnerability.Fixed in 2.8.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running BentoPDF through version 2.8.6 are exposed when the Cloudflare CORS proxy worker is deployed without PROXY_SECRET validation enabled. The attack also depends on the worker having network reachability to the private or link-local target.
What does an attacker need to exploit this?
The attacker needs to directly access the proxy, control authoritative DNS for a supplied certificate, OCSP, CRL, or TSA hostname, and forge the Origin header. They must make DNS return a public address during validation and a private or link-local address for the subsequent fetch, requiring precise timing.
Are redirects or IP-address URLs viable bypasses?
No. Redirects and IP-literal obfuscation are blocked; exploitation relies on DNS rebinding between the DNS-over-HTTPS safety check and the outbound fetch.
What can be done before updating?
Enable PROXY_SECRET validation on the Cloudflare CORS proxy worker to prevent direct unauthenticated use of the endpoint. Also restrict the worker's network reachability to private and link-local services where possible.
What version contains the fix?
The issue is fixed in BentoPDF version 2.8.7.