Resource Caching Vulnerability in pdfmake Affects bpampuch

CVE-2026-119743

What is CVE-2026-119743?

A shared resource caching vulnerability in pdfmake before version 0.3.14 enables attackers to exploit a process-wide virtual file system that uses URLs as its key, without incorporating request headers or specific per-document access controls. This flaw allows unauthorized retrieval of resources previously fetched by other users, leading to potential cross-document information disclosure. Attackers can bypass existing access policies, compromising the security and confidentiality of sensitive data within applications utilizing pdfmake.

References