CVE-2026-68539 · Package
NO FIX YET · SEE WHAT TO DO
fulgur is a library that converts HTML and CSS into PDF files. A small crafted document makes it accumulate unbounded memory and CPU work, so an attacker can cause a denial of service.
first public Jul 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Services that render PDFs from HTML or CSS supplied by users or other tenants are exposed, since a single crafted document can exhaust memory. Applications that only render trusted, internally authored templates are less exposed. unknown whether the sources list other ecosystems or package names.
Not affected if trusted-input-only, versions-outside-range
Who cares multi-tenant, pdf-generation, server-side-rendering
0.4.4 up to but not including 0.29.00.29.0 or laterfulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.