CVE-2026-82864

Name of the Vulnerable Software and Affected Versions pdfme pdf-lib versions prior to 5.5.10

Description An unbounded buffer growth issue exists in the DecodeStream.ensureBuffer() method. This allows an attacker to cause a denial of service by providing a specially crafted PDF containing a FlateDecode stream with a decompression bomb. A decompression bomb is a small compressed file that expands to an extremely large size when decompressed. In this case, a small PDF can decompress to hundreds of megabytes, leading to memory exhaustion that crashes the Node.js process or freezes browser tabs during PDF parsing. The issue occurs because the ensureBuffer() method doubles its internal buffer without an upper bound on the decompressed size, and the decode() function performs unconditional full decompression.

Recommendations Update pdfme pdf-lib to version 5.5.10 or later. As a temporary mitigation, restrict the ability for users to upload or supply the basePdf parameter used in PDF templates.