CVE-2025-11362 pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding
An attacker can cause a denial of service in applications using the pdfmake library by triggering resource exhaustion via crafted file embedding URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11362?
CVE-2025-11362 is a high-severity denial of service vulnerability in org.webjars.npm:pdfmake, published on 7 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
Weakness: CWE-770
Which versions are affected by CVE-2025-11362?
2 open source packages ship an affected version, including pdfmake. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pdfmake npm | From 0.3.0-beta.1 | 0.3.0-beta.17 |
pdfmake npm | From 0.3.0-beta.1 | 0.3.0-beta.17 |
Products include Pdfmake Pdfmake.
How do I fix CVE-2025-11362?
Upgrade pdfmake to 0.3.0-beta.17 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-11362 being exploited?
There is no known exploitation of CVE-2025-11362 in the wild and no public exploit code.
Other vulnerabilities in org.webjars.npm:pdfmake
Sources
Also known as GHSA-rj3r-r7hh-jxfq, MINI-4g96-v3c3-x9qj, MINI-8hx6-cvvm-6954, MINI-jchc-m95h-crj2, MINI-q4xc-hhhf-g2cw, MINI-qjm3-49rv-mh76 and 2 more.