Server-Side Request Forgery in PDFme Common Library

Executive Summary

CVE-2026-82866 is a Server-Side Request Forgery (SSRF) vulnerability in the @pdfme/common library before version 5.5.10. It exists in the getB64BasePdf function, which fetches URLs without validation when the basePdf parameter is attacker-controlled. This allows forcing servers or clients to make requests to arbitrary internal or external endpoints.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses @pdfme/common versions before 5.5.10. Inspect network logs for unexpected outbound requests from the application, especially to internal or reserved IP ranges. Use tools like curl or wget to test if the getB64BasePdf function accepts arbitrary URLs without validation.

Useful 0 Not Useful 0

Impact Analysis

Attackers exploiting this can force requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery. In server-side rendering contexts, it may allow probing internal networks or accessing cloud metadata like AWS IAM credentials. In browser contexts, it could trigger state-changing requests to internal services.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade @pdfme/common to version 5.5.10 or later. Implement strict URL validation in the getB64BasePdf function to block private/reserved IP ranges and restrict protocols to HTTPS or HTTP. Monitor network traffic for suspicious outbound requests.

Useful 0 Not Useful 0