CVE-2026-115729 pdfme CVE debrief

Who should care

Defenders responsible for systems using @pdfme/common, especially in environments where internal or cloud metadata access could be sensitive, should assess exposure and prioritize verification and updates.

Why it matters

CVE-2026-115729 is a server-side request forgery vulnerability in @pdfme/common that allows attackers to bypass security controls and potentially access sensitive metadata responses. Defenders should prioritize verification and updates to prevent potential SSRF attacks and unauthorized access to sensitive information.

• Potential unauthorized access to internal or cloud metadata responses
• Possible bypass of security controls for metadata access
• Risk of sensitive information disclosure through generated documents
• Need for verification and updates to prevent potential SSRF attacks

Technical summary

The @pdfme/common library versions 5.5.10 before 6.2.6 contains a server-side request forgery (SSRF) vulnerability. This vulnerability allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf by supplying basePdf URLs using IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. This could potentially lead to unauthorized access to loopback, internal, or cloud metadata responses through generated documents.

Defensive priority

Defenders should prioritize verifying and updating @pdfme/common to version 6.2.6 or later, and assess exposure in their environments, especially where internal or cloud metadata access could be sensitive.

Recommended defensive actions

• Verify and update @pdfme/common to version 6.2.6 or later
• Assess exposure in environments where internal or cloud metadata access could be sensitive
• Monitor for potential unauthorized access to metadata responses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and related advisories. The affected versions and patches are noted. Specific exploitation details are not provided, but defenders should verify and update @pdfme/common to version 6.2.6 or later and assess exposure in their environments, especially where internal or cloud metadata access could be sensitive. The CVE record was published on 2026-10-23T12:55:09.157Z and has not been modified since then. No additional information is available on exploitation or affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.