GHSA-vrqm-gvq7-rrwh

## Summary The `DecodeStream.ensureBuffer()` method in `@pdfme/pdf-lib` doubles its internal buffer without any upper bound on the decompressed size. A crafted PDF containing a FlateDecode stream with a high compression ratio (decompression bomb) causes unbounded memory allocation during stream decoding, leading to memory exhaustion and denial of service in both server-side (generator) and client-side (UI) contexts. ## Details The vulnerability exists in the `DecodeStream` class, which is the base class for all stream decoders including `FlateStream` (DEFLATE/zlib decompression). **Unbounded buffer growth in `ensureBuffer()`** — `packages/pdf-lib/src/core/streams/DecodeStream.ts:148-160`: ```typescript protected ensureBuffer(requested: number) { const buffer = this.buffer; if (requested <= buffer.byteLength) { return buffer; } let size = this.minBufferLength; while (size < requested) { size *= 2; // Doubles with no upper bound } const buffer2 = new Uint8Array(size); // Allocates without limit buffer2.set(buffer); return (this.buffer = buffer2); } ``` The `size *= 2` loop has no maximum size check. The buffer will continue doubling until the process runs out of memory. **Unconditional full decompression in `decode()`** — `DecodeStream.ts:139-141`: ```typescript decode(): Uint8Array { while (!this.eof) this.readBlock(); // Fully decompresses before returning return this.buffer.subarray(0, this.bufferLength); } ``` **`FlateStream.readBlock()`** calls `ensureBuffer()` repeatedly during decompression — `packages/pdf-lib/src/core/streams/FlateStream.ts:272-274`: ```typescript if (pos + 1 >= limit) { buffer = this.ensureBuffer(pos + 1); limit = buffer.length; } ``` And again at line 297-300: ```typescript if (pos + len >= limit) { buffer = this.ensureBuffer(pos + len); limit = buffer.length; } ``` **Entry point via `basePdf`** — `packages/generator/src/helper.ts:42-43`: ```typescript const willLoadPdf = await getB64Bas