CVE-2026-82864: pdfme pdf-lib DOS Vulnerability

CVE-2026-82864 Overview

CVE-2026-82864 is a denial of service vulnerability in pdfme pdf-lib versions before 5.5.10. The flaw resides in the DecodeStream.ensureBuffer() method, which fails to bound buffer growth during PDF stream decoding. Attackers can supply a crafted PDF containing a FlateDecode decompression bomb, where a small compressed stream expands to hundreds of megabytes on parsing. This exhausts process memory and crashes the Node.js runtime or freezes browser tabs handling the file. The weakness is classified under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

Critical Impact
Any application that ingests untrusted PDFs through pdfme pdf-lib below 5.5.10 can be forced into memory exhaustion with a small malicious upload, taking down PDF processing services.

Affected Products

pdfme pdf-lib versions prior to 5.5.10
Node.js applications embedding pdfme for server-side PDF parsing or generation
Browser-based applications using pdfme pdf-lib for client-side PDF rendering

Discovery Timeline

2026-08-31 - CVE-2026-82864 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82864

Vulnerability Analysis

The vulnerability lives in pdfme pdf-lib's PDF stream decoding path. When the parser encounters an embedded stream filtered with FlateDecode, it calls DecodeStream.ensureBuffer() to grow an internal buffer to accommodate decompressed output. The method grows the buffer without enforcing a maximum size or comparing the resulting length against a sanity limit.

A crafted PDF can declare a stream that compresses to a few kilobytes but expands to hundreds of megabytes of zero-filled data. During inflation, ensureBuffer() repeatedly doubles allocations until the runtime is out of memory. In Node.js, this manifests as an out-of-memory crash of the worker process. In browsers, the tab becomes unresponsive and the renderer is killed.

Root Cause

The root cause is the absence of an upper bound on decompressed stream size inside DecodeStream.ensureBuffer(). The decoder trusts the compressed input to describe a reasonable output length. This is a classic data amplification pattern tracked as CWE-409, where attacker-controlled compression ratios translate directly into victim memory consumption.

Attack Vector

Exploitation requires an attacker to submit a malicious PDF to any endpoint or client that parses it with pdfme pdf-lib. Typical paths include document upload forms, email attachment processors, print-to-PDF services, and browser previews. The attacker needs no authentication beyond whatever the target application requires for file submission, and no user interaction beyond the parse trigger. The impact is limited to availability; confidentiality and integrity are not affected. See the GitHub Security Advisory GHSA-vrqm-gvq7-rrwh and the VulnCheck Denial of Service Advisory for additional technical context.

Detection Methods for CVE-2026-82864

Indicators of Compromise

Node.js processes terminating with FATAL ERROR: JavaScript heap out of memory while parsing user-supplied PDFs
Sudden resident memory growth from hundreds of megabytes to multiple gigabytes in a PDF worker within seconds
Repeated browser tab crashes or Aw, Snap! events when previewing specific uploaded PDF documents
Application logs showing DecodeStream or FlateDecode frames on the stack immediately before an OOM kill

Detection Strategies

Inventory dependencies with npm ls @pdfme/pdf-lib or yarn why to identify installations below 5.5.10
Add pre-parse validation that rejects PDFs whose declared or observed compression ratio exceeds a policy threshold
Instrument PDF parsing workers with per-request memory ceilings and log any request that trips the limit

Monitoring Recommendations

Alert on Node.js process out of memory exits correlated with PDF ingestion endpoints
Track RSS and heap metrics per PDF parsing worker and flag outliers against a rolling baseline
Capture and retain a sample of PDFs that trigger memory pressure events for offline forensic review

How to Mitigate CVE-2026-82864

Immediate Actions Required

Upgrade pdfme pdf-lib to version 5.5.10 or later across all Node.js services and front-end bundles
Run PDF parsing inside isolated worker processes with hard memory limits so a crash cannot take down the parent service
Rate limit PDF upload endpoints and enforce a strict maximum file size at the ingress layer

Patch Information

The fix is included in pdfme pdf-lib 5.5.10. Refer to the GitHub Security Advisory GHSA-vrqm-gvq7-rrwh for the official patch metadata and release notes.

Workarounds

Pre-scan PDFs and reject files whose compressed-to-decompressed size ratio exceeds a safe threshold, such as 100:1
Run PDF parsing under a supervisor that restarts crashed workers and quarantines the triggering input
Restrict PDF ingestion to authenticated users and apply per-user quotas until upgrading is possible

bash

# Upgrade pdfme pdf-lib to the fixed release
npm install @pdfme/pdf-lib@^5.5.10

# Verify no vulnerable versions remain in the dependency tree
npm ls @pdfme/pdf-lib

# Run Node.js PDF workers with a bounded heap to contain memory blowups
node --max-old-space-size=512 pdf-worker.js