CVE-2026-26801: pdfmake SSRF Vulnerability

CVE-2026-26801 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in pdfmake, a popular JavaScript library for generating PDF documents. The vulnerability exists in versions 0.3.0-beta.2 through 0.3.5 and allows remote attackers to obtain sensitive information via the src/URLResolver.js component. This SSRF flaw enables attackers to abuse the server's ability to make HTTP requests, potentially accessing internal resources, cloud metadata services, or other sensitive endpoints that should not be publicly accessible.

Critical Impact

Remote attackers can exploit this SSRF vulnerability to access sensitive internal resources and data, potentially leading to information disclosure, internal network reconnaissance, or further exploitation of backend systems.

Affected Products

• pdfmake versions 0.3.0-beta.2 through 0.3.5
• Server-side Node.js deployments using vulnerable pdfmake versions
• Applications utilizing pdfmake's URL resolution functionality without access policies

Discovery Timeline

• 2026-03-10 - CVE-2026-26801 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-26801

Vulnerability Analysis

This Server-Side Request Forgery vulnerability is classified under CWE-918 (Server-Side Request Forgery). The vulnerability exists within the URL resolution mechanism of pdfmake, specifically in the URLResolver.js component. When pdfmake processes PDF document definitions containing URLs (such as image sources or external resources), the URL resolver fetches these resources without proper validation or access control policies.

The vulnerable component fails to restrict which URLs can be requested, allowing attackers to craft malicious PDF document definitions that cause the server to make requests to arbitrary URLs. This includes internal network addresses, localhost services, and cloud metadata endpoints. The impact is characterized by high confidentiality impact with no integrity or availability impact, as the vulnerability primarily enables information disclosure.

Root Cause

The root cause of this vulnerability lies in the absence of URL access policy enforcement within the URLResolver.js component. Prior to version 0.3.6, pdfmake did not provide any mechanism for server operators to define which URLs the library should be permitted to access. This meant that any URL provided in a PDF document definition would be fetched by the server without restriction, creating a classic SSRF attack surface.

The fix introduced in version 0.3.6 adds the setUrlAccessPolicy() method, which allows administrators to define explicit rules governing URL access. Additionally, the patched version now logs a warning when pdfmake is used server-side without a policy configured, alerting operators to the potential security risk.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by submitting a crafted PDF document definition to a vulnerable application that uses pdfmake server-side. The malicious document definition would contain URLs pointing to internal resources that the attacker wishes to access.

When the server processes this document definition, the vulnerable URLResolver.js component fetches the specified URLs, effectively making requests on behalf of the attacker. The responses from these internal resources may be included in the generated PDF or reflected back to the attacker through other means, leading to information disclosure.

Common exploitation targets include cloud metadata services (such as AWS http://169.254.169.254/), internal APIs, administrative interfaces, and database management consoles that are typically protected from external access.

Detection Methods for CVE-2026-26801

Indicators of Compromise

• Unusual outbound HTTP requests from the application server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints originating from the pdfmake service
• Unexpected network connections to localhost ports from the Node.js application
• Log entries showing URL resolution attempts for internal or restricted addresses

Detection Strategies

• Monitor application logs for URL resolution requests containing internal IP addresses or localhost references
• Implement network-level monitoring to detect outbound connections from the pdfmake service to internal network segments
• Deploy web application firewalls (WAF) with rules to detect SSRF patterns in request payloads
• Review pdfmake warning logs for missing URL access policy notifications (in version 0.3.6+)

Monitoring Recommendations

• Enable verbose logging in the pdfmake service to capture all URL resolution attempts
• Configure alerting for any HTTP requests to metadata service IP ranges (e.g., 169.254.169.254)
• Implement egress filtering and monitor for policy violations from application servers
• Conduct regular security audits of PDF document definitions processed by the application

How to Mitigate CVE-2026-26801

Immediate Actions Required

• Upgrade pdfmake to version 0.3.6 or later immediately
• Audit existing deployments to identify server-side pdfmake usage with vulnerable versions
• Implement network-level egress filtering to restrict outbound requests from application servers
• Review generated PDFs and logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been addressed in pdfmake version 0.3.6, which introduces the setUrlAccessPolicy() method for defining URL access rules. Server operators should upgrade to this version and configure an appropriate URL access policy to prevent SSRF attacks.

For more information, see the GitHub pdfmake Release 0.3.6 and Pull Request #2920 for technical details on the fix.

Workarounds

• If immediate upgrade is not possible, implement a network-level allow list for outbound connections from the application server
• Deploy an HTTP proxy between pdfmake and external resources to filter and validate URL requests
• Sanitize and validate all URLs in PDF document definitions before passing them to pdfmake
• Consider disabling external URL resolution functionality if not required for your use case

# Upgrade pdfmake to patched version
npm update pdfmake@0.3.6

# Verify installed version
npm list pdfmake