CVE-2026-119743 pdfmake < 0.3.14 Shared Cache Access Policy Bypass

What is CVE-2026-119743?

CVE-2026-119743 is a medium-severity vulnerability in bpampuch pdfmake, published on 9 Nov 2026.

Official description

pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy.

Weakness: CWE-524

Which versions are affected by CVE-2026-119743?

How do I fix CVE-2026-119743?

No fix has been published for CVE-2026-119743 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119743 being exploited?

There is no known exploitation of CVE-2026-119743 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cw47-gww7-39hm.