Server-Side Request Forgery in @pdfme/common Affects Multiple Versions
CVE-2026-115729

8.9HIGH

Key Information:

Vendor

PDFme

Status
Common
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115729?

The @pdfme/common library versions 5.5.10 through to just before 6.2.6 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. This vulnerability allows attackers to circumvent the isUrlSafeToFetch denylist in the getB64BasePdf function. By leveraging techniques such as IPv4-mapped IPv6 addresses, localhost alias hostnames, or NAT64, an attacker can craft requests that access restricted internal services and cloud metadata. This can potentially lead to unauthorized information disclosure, highlighting the importance of updating to the latest version.

Affected Version(s)

common 5.5.10 < 6.2.6

References

https://github.com/pdfme/pdfme/security/advisories/GHSA-2...
vendor-advisory
https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e1...
patch
https://github.com/pdfme/pdfme/security/advisories/GHSA-p...
relatedvendor-advisory

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.