MEDIUMVulnerability
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.
Properties
- severity
- MEDIUM
- score
- 6.5
- epss_score
- 0.00249
- cve_id
- CVE-2026-82864
- signal_observed_at
- 2026-09-15T21:12:48+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- published_at
- 2026-08-31T09:17:06.957
- last_modified
- 2026-09-10T15:53:23.707
- epss_percentile
- 0.16325
Related Entities (3)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (1)
→[Weakness]Improper Handling of Highly Compressed Data (Data Amplification)
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph