Read the docs
TI-2026-79748 Aliases CVE-2026-115729GHSA-wf6h-pqhw-phmv

Server-side request forgery in @pdfme/common denylist bypass

Priority HIGH 72CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability in getB64BasePdf. Attackers can bypass the isUrlSafeToFetch denylist by supplying basePdf URLs that use IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames. A remote attacker without privileges can read loopback, internal or cloud metadata responses through generated documents (CWE-918).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed common (pdfme): 6.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pdfmecommon5.5.10 to before 6.2.66.2.6Patch availableCNA
  • common Vendorpdfme Affected 5.5.10 to before 6.2.6 Fixed in 6.2.6 Patch available CNA

Remediation

Update @pdfme/common to version 6.2.6. The sources list no fixed version for other branches.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA common (pdfme) Fixed in 6.2.6

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115729
  2. 2026-10-23 Alias added: GHSA-wf6h-pqhw-phmv
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → HIGH

References

Patch 1

Advisory 2

  • TI-2026-57170 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch CVSS 4.0HIGH 8.9
  • TI-2025-33553 pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation CVSS 3.1MEDIUM 6.1
  • TI-2026-57172 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG CVSS 4.0MEDIUM 5.3
  • TI-2026-57171 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select CVSS 4.0MEDIUM 5.3
  • TI-2026-57169 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label CVSS 4.0LOW 2.1
  • TI-2026-57168 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences