Live › vulnerability › CVE-2026-115729
Go to dashboardThe @pdfme/common package fetches a PDF base URL supplied by the caller, and its denylist can be bypassed with IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames. An attacker can read loopback, internal network and cloud metadata responses through the generated documents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade @pdfme/common to 6.2.6 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
This page as .md · .json · in your agent: get_signal("CVE-2026-115729")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.