CORS Proxy Vulnerability in BentoPDF Affects Internal Hostnames

CVE-2026-77581

What is CVE-2026-77581?

The BentoPDF toolkit, specifically in versions 2.8.6 and earlier, contains a vulnerability linked to the validation process of hostnames in the CORS proxy located in cloudflare/cors-proxy-worker.js. This flaw enables an attacker to control the hostname, which could resolve to internal or reserved endpoints following validation. Additionally, without the PROXY_SECRET, the optional signature check is bypassed, limiting the protections intended against abuse. The vulnerability impacts both official and self-hosted instances capable of reaching sensitive internal destinations. This issue was rectified in version 2.8.7.

References