CVE-2026-82864

pdfme pdf-lib before version 5.5.10 contains an unbounded buffer growth flaw (CWE-409) in the DecodeStream.ensureBuffer() method used when parsing PDF streams. An attacker who can supply a crafted PDF, for example by uploading a file to a web service that parses it, can embed a FlateDecode stream that is small in compressed form but expands to hundreds of megabytes, causing the parser to allocate memory without limit. The result is denial of service: the Node.js process can be killed by memory exhaustion, or a browser tab can freeze during PDF parsing. Any application, API, or website that parses attacker-supplied PDFs with an affected version is exposed, while deployments that only generate PDFs without parsing untrusted input are largely unaffected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at about 0.2%, so no active exploitation is currently known.

What to do: Upgrade pdf-lib (including when pulled in via pdfme) to version 5.5.10 or later. Until upgraded, cap uploaded PDF file sizes, run parsing of untrusted PDFs in isolated worker processes or sandboxes with memory limits and timeouts so a decompression bomb cannot take down the main service. Audit your dependency tree to confirm the resolved pdf-lib version is 5.5.10 or later.