CVE-2026-82864: pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pdfme pdf-libto a version that resolves this vulnerability.Fixed in 5.5.10
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected pdfme pdf-lib versions to parse PDFs supplied by users or other untrusted sources are exposed. A successful attack can crash a Node.js process or freeze a browser tab during PDF parsing.
What does an attacker need to exploit it?
The attacker needs the ability to provide a crafted PDF containing a FlateDecode stream with a decompression bomb to an affected PDF-parsing workflow. The supplied file can be small when compressed but expand to hundreds of megabytes in memory.
Are affected versions identified?
Versions of pdfme pdf-lib before 5.5.10 are affected. The provided data does not state whether any particular application configuration avoids the vulnerable parsing path.