CVE-2026-77581: BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWEDPATHPATTERNS, and direct clients can forge the browser-oriented Origin header. Deployments without PROXYSECRET skip the optional signature check, while the signature is an anti-abuse measure rather than a destination-security boundary. The proxy has a 10 MB response limit and can relay response bodies from reachable destinations. The advisory identifies both the official Worker deployment and self-hosted instances as impacted where the Worker execution environment can reach internal or reserved destinations. This vulnerability is fixed in 2.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BentoPDFto a version that resolves this vulnerability.Fixed in 2.8.7
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Both the official Worker deployment and self-hosted instances are impacted if the Worker execution environment can reach internal or reserved destinations. Versions 2.8.6 and earlier are affected.
What does an attacker need to exploit this issue?
An attacker can directly send requests to the proxy, forge the browser-oriented Origin header, and supply an attacker-controlled hostname that passes validation but resolves to an internal or reserved destination. A certificate-like path must also satisfy the proxy's allowed path patterns.
Does configuring PROXY_SECRET prevent access to internal destinations?
No. Deployments without PROXY_SECRET skip the optional signature check, but the signature is described as an anti-abuse measure rather than a destination-security boundary.
What can an attacker retrieve through the vulnerable proxy?
The proxy can relay response bodies from destinations reachable by the Worker, subject to a 10 MB response limit.
What is the remediation?
Upgrade BentoPDF to version 2.8.7, which fixes the vulnerability.