Description

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T09:17:06.957Z",
  "pubdate": "2026-08-31T09:17:06.957Z",
  "executiveSummary": "The pdf-lib library, utilized by pdfme, is susceptible to an unbounded buffer growth vulnerability identified in the DecodeStream.ensureBuffer() method. This vulnerability is classified as a Denial of Service (DoS) flaw originating from insufficient resource constraints during the decompression of PDF streams.\nBy submitting a maliciously crafted PDF file containing a FlateDecode stream—a common compression method in PDF specifications—an attacker can trigger a decompression bomb. This process forces the library to allocate memory disproportionately to the original size of the compressed data, leading to massive memory consumption.\nThe impact of successful exploitation is significant, potentially causing the Node.js process to terminate due to out-of-memory (OOM) errors in backend environments or freezing the event loop and browser threads in client-side implementations. There are no authentication requirements to trigger this vulnerability, as it manifests during the standard parsing phase of a PDF document.\nOrganizations relying on affected versions should prioritize updating to version 5.5.10 or later to ensure proper resource management during decompression tasks. Failure to address this flaw leaves systems exposed to trivial DoS attacks capable of disrupting critical document processing pipelines.",
  "technicalDetails": "The vulnerability resides within the DecodeStream.ensureBuffer() method of the pdf-lib library. This function is responsible for dynamically expanding the internal buffer while decompressing PDF data streams, specifically those encoded with FlateDecode (zlib).\nThe root cause of the vulnerability is the lack of strict upper-bound limits or validation checks on the decompressed output size relative to the original compressed input size. When the library encounters a FlateDecode stream, it attempts to buffer the decompressed output. A crafted PDF can define a stream that exhibits an extreme compression ratio, such that a few kilobytes of compressed data expand into hundreds of megabytes or even gigabytes of uncompressed output.\nThe exploitation flow is straightforward: an attacker provides a maliciously crafted PDF document through a file upload interface or a document processing endpoint. Upon ingestion, the library's parser initiates the decompression routine for the embedded stream. As DecodeStream.ensureBuffer() continuously allocates memory to accommodate the rapidly expanding data, the Node.js process encounters a catastrophic memory spike.\nIn server-side Node.js environments, this behavior typically triggers an 'OutOfMemory' exception, causing the application process to crash. In browser-based environments, the browser tab becomes unresponsive as the main thread enters a loop attempting to satisfy the memory allocation request, effectively resulting in a full freeze of the user interface.\nThe vulnerability is present in all versions of pdf-lib prior to 5.5.10. There are no specific privilege requirements for exploitation; the parser executes the decompression logic regardless of the origin of the document. As the library is designed to process external or user-provided input, the attack surface is inherent to any feature that allows document uploading, parsing, or manipulation within an application."
}