CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
Attackers can cause denial of service by uploading crafted PDFs that trigger unbounded memory growth during decompression, crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82864?
CVE-2026-82864 is a high-severity denial of service vulnerability in pdfme pdf-lib, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small compressed PDF that decompresses to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing.
Weakness: CWE-409
Which versions are affected by CVE-2026-82864?
2 open source packages ship an affected version, including @pdfme/pdf-lib.
| Package | Affected | Fixed in |
|---|---|---|
@pdfme/pdf-lib npm | All versions | 5.5.10 |
@pdfme/pdf-lib npm | All versions | 5.5.10 |
How do I fix CVE-2026-82864?
Upgrade @pdfme/pdf-lib to 5.5.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82864 being exploited?
There is no known exploitation of CVE-2026-82864 in the wild and no public exploit code.
Sources
Also known as GHSA-gvgq-37w5-4f8q, GHSA-vrqm-gvq7-rrwh.