CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
Attackers can force servers to fetch arbitrary internal URLs via unvalidated basePdf templates, enabling metadata exfiltration and network reconnaissance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82866?
CVE-2026-82866 is a high-severity server-side request forgery vulnerability in pdfme common, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Weakness: CWE-918
Which versions are affected by CVE-2026-82866?
2 open source packages ship an affected version, including @pdfme/common.
| Package | Affected | Fixed in |
|---|---|---|
@pdfme/common npm | All versions | 5.5.10 |
@pdfme/common npm | All versions | 5.5.10 |
How do I fix CVE-2026-82866?
Upgrade @pdfme/common to 5.5.10 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-82866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82866 exists.
Sources
Also known as GHSA-4jj6-4ggm-xjcj, GHSA-pgx6-7jcq-2qff.