CVE-2026-119743: pdfmake < 0.3.14 Shared Cache Access Policy Bypass
pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to cross-document resource disclosure?
Deployments using pdfmake before 0.3.14 are affected when documents share a process-wide virtual file-system cache and fetch resources by URL. The issue is relevant where different callers, credentials, or document-level URL access policies are handled by the same process.
What must an attacker be able to do to exploit this?
An attacker needs to cause a document to request a URL that has already been cached after being fetched by another caller or with other credentials. The cache is keyed only by URL, so request headers and per-document access enforcement are not considered for the cached resource.
What information or policy can be bypassed?
A later document can retrieve a resource fetched using another caller's credentials, causing cross-document information disclosure. It can also obtain a resource from a URL that its own document-level access policy would deny.
Which version addresses the issue?
Version 0.3.14 addresses the vulnerability. Versions before 0.3.14 are affected.