CVE-2025-11362

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2025-10-07

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• pdfmake:pdfmake

Packages (OSV)

References

• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297

Check your stackJSON