CyberRota Analysis
AI-GeneratedVersions of pdfme pdf-lib prior to 5.5.10 are vulnerable to an unbounded buffer growth issue in the DecodeStream.ensureBuffer() method, which can be exploited by attackers through specially crafted PDFs containing a FlateDecode stream. This vulnerability can lead to denial of service by exhausting memory resources, potentially crashing Node.js processes or freezing browser tabs during PDF parsing. Organizations utilizing this library should prioritize updates to mitigate the risk of service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.