PT-2025-40963 · Pdfmake · Pdfmake

Ryusei Ishikawa · Published 2025-10-07 · Updated 2025-10-20 · CVE-2025-11362

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions pdfmake versions prior to 0.3.0-beta.17

Description The software is susceptible to a denial-of-service condition due to unrestricted resource allocation. This occurs when processing crafted input that repeatedly redirects URLs during file embedding, potentially leading to application crashes or unresponsiveness.

Recommendations Update to version 0.3.0-beta.17 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-11362

GHSA-RJ3R-R7HH-JXFQ

Affected Products

Pdfmake

References · 17

• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed · Patch
• https://osv.dev/vulnerability/GHSA-rj3r-r7hh-jxfq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11362 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11362 · Vendor Advisory
• https://github.com/bpampuch/pdfmake · Note
• https://github.com/bpampuch/pdfmake/issues/2886 · Note
• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297 · Note
• https://twitter.com/CVEnew/status/1975434228549464338 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://t.me/cveNotify/137606 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o1aw7v/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://t.me/cveNotify/139417 · Telegram Post
• https://twitter.com/offseq/status/1975441599598387638 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975434850120221072 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post