HTML/CSS Processing Vulnerability in Fulgur by Fulgur Inc.

CVE-2026-68523

What is CVE-2026-68523?

Fulgur, which is designed to convert untrusted HTML and CSS into PDFs, has a vulnerability that could lead to excessive resource consumption when processing input. In earlier versions, specifically those prior to 0.19.0, a flaw was identified where a child element's CSS-resolved height could exceed the page height significantly, causing the program to generate an unbounded number of pages. This issue has been resolved in version 0.19.0 through the introduction of a MAX_PAGES limit, which restricts the loop that generates pages to prevent excessive fragmentation. It's crucial for users to validate or constrain CSS inputs, especially those affecting heights, to further ensure system stability and security when using Fulgur.

References