CVE-2026-65842 udecode CVE debrief

Who should care

Developers and administrators using the Plate rich-text editor with @platejs/docx-io, especially those with high-security requirements, should be aware of this vulnerability and take immediate action to patch or mitigate it. Affected operators include developers, administrators, and security teams. The vulnerability affects platform security, vulnerability management, and security team operations. Compensating controls and monitoring are recommended while remediation is scheduled and verified. Asset inventory checks should be conducted to identify and patch vulnerable systems. The vulnerability management process should include tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. The security team should review and update incident response plans to address potential data breaches. The affected product deployments should be reviewed for potential security risks and mitigated accordingly. The vulnerability class and likely operational impact should be understood by the security team to ensure effective incident response. The source-confidence limits and review context should be evaluated to ensure the accuracy of the vulnerability information. The security team should also monitor for suspicious activity and exception tracking to detect potential attacks. The affected product or component is Plate rich-text editor with AI and shadcn/ui. The vulnerability class is server-side request forgery with response disclosure. The likely operational impact is unauthorized access to internal network resources and potential data breaches. The source-confidence limits are based on the provided source corpus. The review context includes the CVE record and NVD detail. The security team should review compensating controls for exposed systems while remediation is scheduled and verified. The asset inventory checks should be conducted to identify and patch vulnerable systems. The security team should track exceptions, retest remediated assets, and close the item only after evidence is documented. The incident response plans should be reviewed and updated to address potential data breaches. The affected product deployments should be

Technical summary

The @platejs/docx-io library is vulnerable to server-side request forgery with response disclosure. When converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment, the library fetches remote image URLs, allowing attackers to make requests to internal network resources and include the fetched image bytes in the generated DOCX. This can lead to unauthorized access to internal network resources and potential data breaches. The vulnerability is fixed in version 53.3.2.

Defensive priority

CVE-2026-65842 is rated HIGH with a CVSS score of 8.2, indicating a significant vulnerability. Server-side request forgery with response disclosure can lead to unauthorized access to internal network resources and potential data breaches.

Recommended defensive actions

• Review and update @platejs/docx-io to version 53.3.2 or later
• Implement compensating controls to monitor and restrict access to internal network resources
• Conduct inventory checks to identify and patch vulnerable systems
• Monitor for suspicious activity and exception tracking
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability exists in @platejs/docx-io, which fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. This allows server-side request forgery with response disclosure and can lead to resource consumption from attacker-selected remote responses. The affected product is Plate rich-text editor with AI and shadcn/ui. The vulnerability class is server-side request forgery with response disclosure. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources