CVE-2026-77581
Received Received - Intake

BentoPDF Certificate Proxy Hostname Spoofing Vulnerability

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the browser-oriented Origin header. Deployments without PROXY_SECRET skip the optional signature check, while the signature is an anti-abuse measure rather than a destination-security boundary. The proxy has a 10 MB response limit and can relay response bodies from reachable destinations. The advisory identifies both the official Worker deployment and self-hosted instances as impacted where the Worker execution environment can reach internal or reserved destinations. This vulnerability is fixed in 2.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-77581
EUVD
EUVD-2026-86229

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bentopdf bentopdf to 2.8.7 (exc)
bentopdf bentopdf 2.8.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77581 is a Server-Side Request Forgery (SSRF) vulnerability in BentoPDF's certificate and timestamp CORS proxy (cloudflare/cors-proxy-worker.js) affecting versions up to 2.8.6. The flaw allows attackers to bypass hostname restrictions by exploiting DNS-based allowlist bypass. The isPrivateOrReservedHost() function only checks the hostname as a literal string, not its resolved IP address, enabling attackers to register domains pointing to internal or reserved IPs. This allows arbitrary requests to internal networks.

Detection Guidance

To detect this SSRF vulnerability in BentoPDF's CORS proxy, monitor outbound requests to internal or reserved IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8). Check logs for unusual certificate or timestamp proxy requests. Use network tools like tcpdump or Wireshark to inspect traffic patterns.

Impact Analysis

An attacker could exploit this to send requests to internal or reserved network destinations, potentially accessing sensitive data or services. The proxy can relay responses up to 10 MB from internal resources, posing confidentiality risks. Spoofable Origin headers and optional HMAC signature bypass in self-hosted deployments further increase exposure. Attackers may forge browser-oriented Origin headers or bypass signature checks if PROXY_SECRET is not set.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data such as personal or health information. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data accessed. Unauthorized data exposure or exfiltration risks could result in regulatory penalties or compliance failures.

Mitigation Strategies

Upgrade to BentoPDF v2.8.7 or later immediately to address the vulnerability. If upgrading is not possible, disable the CORS proxy worker or restrict its access to internal networks. Ensure PROXY_SECRET is configured to enable signature verification. Implement network-level egress filtering to block outbound connections to private, loopback, and reserved IP ranges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart