Resource allocation without limits in pdfmake
Priority LOW 38CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed pdfmake: 0.3.0-beta.17org.webjars.npm:pdfmake: 0.3.0-beta.18+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pdfmake | 0.3.0-beta.1 to before 0.3.0-beta.17 | 0.3.0-beta.17 | Patch available | CNA |
| — | org.webjars.npm:pdfmake | 0.3.0-beta.1 to before 0.3.0-beta.18 | 0.3.0-beta.18 | Patch available | CNA |
| — | pdfmake (npm) | 0.3.0-beta.1 to before 0.3.0-beta.17 | 0.3.0-beta.17 | Patch available | GHSA-rj3r-r7hh-jxfq |
- pdfmake Vendor— Affected 0.3.0-beta.1 to before 0.3.0-beta.17 Fixed in 0.3.0-beta.17 Patch available CNA
- org.webjars.npm:pdfmake Vendor— Affected 0.3.0-beta.1 to before 0.3.0-beta.18 Fixed in 0.3.0-beta.18 Patch available CNA
- pdfmake (npm) Vendor— Affected 0.3.0-beta.1 to before 0.3.0-beta.17 Fixed in 0.3.0-beta.17 Patch available GHSA-rj3r-r7hh-jxfq
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta1:*:*:*:*:*:* | 0.3.0 beta1 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:* | 0.3.0 beta10 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:* | 0.3.0 beta11 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:* | 0.3.0 beta12 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:* | 0.3.0 beta13 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:* | 0.3.0 beta14 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:* | 0.3.0 beta15 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:* | 0.3.0 beta16 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:* | 0.3.0 beta2 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:* | 0.3.0 beta3 | Vulnerable | Pdfmake |
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta1:*:*:*:*:*:* Versions 0.3.0 beta1 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:* Versions 0.3.0 beta10 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:* Versions 0.3.0 beta11 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:* Versions 0.3.0 beta12 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:* Versions 0.3.0 beta13 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:* Versions 0.3.0 beta14 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:* Versions 0.3.0 beta15 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:* Versions 0.3.0 beta16 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:* Versions 0.3.0 beta2 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:* Versions 0.3.0 beta3 Vulnerable ·Pdfmake
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:* | 0.3.0 beta4 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:* | 0.3.0 beta5 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:* | 0.3.0 beta6 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:* | 0.3.0 beta7 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:* | 0.3.0 beta8 | Vulnerable | Pdfmake |
| cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:* | 0.3.0 beta9 | Vulnerable | Pdfmake |
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:* Versions 0.3.0 beta4 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:* Versions 0.3.0 beta5 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:* Versions 0.3.0 beta6 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:* Versions 0.3.0 beta7 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:* Versions 0.3.0 beta8 Vulnerable ·Pdfmake
- cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:* Versions 0.3.0 beta9 Vulnerable ·Pdfmake
Remediation
- Fix · CNA pdfmake Fixed in 0.3.0-beta.17
- Fix · CNA org.webjars.npm:pdfmake Fixed in 0.3.0-beta.18
- Fix · GHSA-rj3r-r7hh-jxfq pdfmake (npm) Fixed in 0.3.0-beta.17 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11362
- 2026-10-03 Alias added: GHSA-rj3r-r7hh-jxfq
References
More Pdfmake vulnerabilities
- TI-2022-22805 Code injection in pdfmake CVSS 3.1CRITICAL 10.0
- TI-2026-21390 Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through… CVSS 3.1HIGH 7.5
Sources
- CVE-2025-11362 · CVE Program
- CVE-2025-11362 · NVD
- FIRST EPSS
- GHSA-rj3r-r7hh-jxfq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences