← Vulnerability feed

Vulnerability record · CVE-2025-11362 · published 7 October 2025

CVE-2025-11362: Pdfmake allocation without limits vulnerability

Pdfmake · Pdfmake

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

8.7 CVSS 4.0 High EPSS 0.43% · top 65.7% CWE-770 · Allocation without limits
8.7CVSS 4.0 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
6 Aug 2026Last modified by NVD

Description

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed Patch
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297 Third Party Advisory

Track CVE-2025-11362 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-46161Pdfmake code injection vulnerabilitypdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evalua…EPSS 1.7%7.5CVE-2026-26801Pdfmake server-side request forgery (ssrf) vulnerabilityServer-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive informat…EPSS 0.61%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2025-11362), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.