CVE-2026-82864
Received Received - Intake

pdfme pdf-lib Unbounded Buffer Growth in DecodeStream

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82864
EUVD
EUVD-2026-68399

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pdfme pdf-lib to 5.5.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a decompression bomb flaw in the @pdfme/pdf-lib library affecting versions before 5.5.10. It occurs in the DecodeStream.ensureBuffer() method where the internal buffer size doubles without an upper limit during FlateDecode stream decompression. Attackers exploit this by providing a crafted PDF with a highly compressed FlateDecode stream that decompresses to hundreds of megabytes, causing memory exhaustion and denial of service.

Detection Guidance

To detect this vulnerability, monitor for processes consuming excessive memory during PDF processing. Check for crashes in Node.js applications or browser tabs when handling PDFs. Use tools like 'top' or 'htop' to observe memory usage spikes when processing PDFs with FlateDecode streams.

Impact Analysis

This vulnerability can impact you by causing crashes in Node.js processes or freezing browser tabs when processing malicious PDFs. It allows attackers to exhaust system memory by uploading small compressed PDFs that decompress to massive sizes, disrupting services and applications relying on the pdf-lib library.

Mitigation Strategies

Immediately update the @pdfme/pdf-lib library to version 5.5.10 or later to patch the unbounded buffer growth flaw. If updating is not possible, implement a maximum decoded size limit (e.g., 100 MB) for FlateDecode streams in your PDF processing logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart