CVE-2026-115729

Name of the Vulnerable Software and Affected Versions @pdfme/common versions 5.5.10 through 6.2.5

Description An issue exists in the getB64BasePdf() function where it fetches arbitrary URLs via fetch() without proper validation when basePdf is a non-data-URI string and window is defined. This allows attackers to bypass the isUrlSafeToFetch denylist by using IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. In server-side rendering (SSR) contexts, this can lead to Server-Side Request Forgery (SSRF), enabling attackers to read loopback, internal network, or cloud metadata responses (such as IAM credentials from 169.254.169.254). In browser contexts, it can result in blind request forgery. The vulnerability is triggered via the basePdf variable within the template.

Recommendations Update @pdfme/common to version 6.2.6 or later. As a temporary mitigation, restrict the use of the basePdf variable in templates to only allow trusted, validated URLs and block private or reserved IP ranges.