{"id":"CVE-2026-119743","kind":"vulnerability","aliases":["CVE-2026-119743"],"related":[],"title":"pdfmake: shared cache lets one PDF job read another's fetched resources","description":"pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy.","summary":"pdfmake before 0.3.14 keeps a process-wide virtual file system keyed only by URL, so resources fetched for one document can be reused by a later document. An attacker who can make pdfmake render documents can read resources fetched with another caller's credentials or from URLs their own access policy would deny.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","node","package","pdfmake"],"not_affected_if":["single-tenant","static-content-only"],"how_to_check":"- Check the installed pdfmake version with `npm ls pdfmake` or in the lockfile.\n- Look for services that render untrusted or multi-tenant documents with pdfmake and fetch remote images or fonts by URL.","fix":"- pdfmake: `0.3.14` or later (per the product advisory summary; the linked patch is not read here).","status":"open","published_at":"2026-11-09T14:17:06+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:45+00:00","updated_at":"2026-11-09T14:27:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T14:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- pdfmake: `0.3.14` or later (per the product advisory summary; the linked patch is not read here).","reach":"unknown","title":"pdfmake: shared cache lets one PDF job read another's fetched resources","impact":"medium","summary":"pdfmake before 0.3.14 keeps a process-wide virtual file system keyed only by URL, so resources fetched for one document can be reused by a later document. An attacker who can make pdfmake render documents can read resources fetched with another caller's credentials or from URLs their own access policy would deny.","audience":"developers","category":"package","nicknames":[],"who_cares":["pdfmake","node","multi-tenant"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads cross-document cached resources and bypasses URL access policy","analyst_note":"Confirm the exact trigger conditions and whether the linked patch matches the 0.3.14 fix in the NVD record.","how_to_check":"- Check the installed pdfmake version with `npm ls pdfmake` or in the lockfile.\n- Look for services that render untrusted or multi-tenant documents with pdfmake and fetch remote images or fonts by URL.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["static-content-only","single-tenant"],"who_is_affected":"Applications that use pdfmake to build PDFs from URLs in a process shared by several users, tenants or access policies are exposed. Apps that render only trusted, fixed content with no remote resource fetching are unlikely to be affected. unknown for exact conditions beyond the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4656,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119743':15A,18A '-2026':14A,17A '0.3.14':27B,81C 'access':75B,92C,118C,138C,154C 'allow':89C 'anoth':9A,66B,126C 'attack':54B,90C,120C 'bypass':150C 'cach':3A,86C,96C 'caller':67B,127C 'contain':82C 'credenti':69B,129C 'cross':94C,145C 'cross-docu':93C,144C 'cve':13A,16A 'deni':78B,141C 'disclosur':148C 'document':45B,52B,60B,95C,117C,136C,146C 'enforc':119C 'exploit':99C 'fetch':11A,42B,64B,124C 'file':34B,105C 'header':113C 'inform':147C 'job':7A 'keep':28B 'key':36B,107C 'later':51B,135C 'let':4A 'make':57B 'multi':20B 'multi-ten':19B 'node':22B 'one':5A,44B 'packag':23B 'pdf':6A 'pdfmake':1A,24B,25B,58B,79C 'per':116C 'per-docu':115C 'polici':76B,139C,155C 'process':31B,102C 'process-wid':30B,101C 'read':8A,62B 'render':59B 'request':112C 'resourc':12A,41B,63B,85C,97C,123C 'result':142C 'retriev':122C 'reus':48B 'share':2A,84C 'system':35B,106C 'tenant':21B 'url':39B,72B,110C,132C,153C 'virtual':33B,104C 'vulner':87C 'wide':32B,103C 'without':111C 'would':77B,140C","nicknames":[],"mitigations":[],"who_affected":"Applications that use pdfmake to build PDFs from URLs in a process shared by several users, tenants or access policies are exposed. Apps that render only trusted, fixed content with no remote resource fetching are unlikely to be affected. unknown for exact conditions beyond the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","multitenant","node","package","pdfmake"],"campaign_type":null,"search_a":"'-119743':15A,18A '-2026':14A,17A 'anoth':9A 'cach':3A 'cve':13A,16A 'fetch':11A 'job':7A 'let':4A 'one':5A 'pdf':6A 'pdfmake':1A 'read':8A 'resourc':12A 'share':2A","search_b":"'0.3.14':27B 'access':75B 'anoth':66B 'attack':54B 'caller':67B 'credenti':69B 'deni':78B 'document':45B,52B,60B 'fetch':42B,64B 'file':34B 'keep':28B 'key':36B 'later':51B 'make':57B 'multi':20B 'multi-ten':19B 'node':22B 'one':44B 'packag':23B 'pdfmake':24B,25B,58B 'polici':76B 'process':31B 'process-wid':30B 'read':62B 'render':59B 'resourc':41B,63B 'reus':48B 'system':35B 'tenant':21B 'url':39B,72B 'virtual':33B 'wide':32B 'would':77B","search_c":"'0.3.14':81C 'access':92C,118C,138C,154C 'allow':89C 'anoth':126C 'attack':90C,120C 'bypass':150C 'cach':86C,96C 'caller':127C 'contain':82C 'credenti':129C 'cross':94C,145C 'cross-docu':93C,144C 'deni':141C 'disclosur':148C 'document':95C,117C,136C,146C 'enforc':119C 'exploit':99C 'fetch':124C 'file':105C 'header':113C 'inform':147C 'key':107C 'later':135C 'pdfmake':79C 'per':116C 'per-docu':115C 'polici':139C,155C 'process':102C 'process-wid':101C 'request':112C 'resourc':85C,97C,123C 'result':142C 'retriev':122C 'share':84C 'system':106C 'url':110C,132C,153C 'virtual':104C 'vulner':87C 'wide':103C 'without':111C 'would':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119743","severity":null,"published_at":"2026-11-09T14:17:06+00:00","modified_at":"2026-11-09T14:17:06+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null}],"documents":[{"id":107769,"url":"https://github.com/bpampuch/pdfmake/commit/73aaed7a90699f31036a77f957fe3303693e3c8f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":107770,"url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.14","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":107771,"url":"https://github.com/pdfmake/docs/commit/e8a6e2b2bf728f457ed65c7a1642db7b8446592e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":107772,"url":"https://www.vulncheck.com/advisories/pdfmake-shared-cache-access-policy-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}