CVE-2026-68540 · Package
NO FIX YET · SEE WHAT TO DO
fulgur, a library that converts HTML and CSS into PDF, spends quadratic time reprocessing style lists when absolutely-positioned pseudo-elements are resolved. Crafted untrusted HTML/CSS can make the conversion hang or exhaust resources, denying service to other users.
first public Jul 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed fulgur and render untrusted HTML/CSS to PDF, especially multi-tenant servers where many users submit input. Applications that only render trusted, internally authored templates are much less exposed.
Not affected if fulgur-below-0.6.0-or-0.33.0-plus, trusted-input-only
Who cares fulgur, multi-tenant, pdf-generation
0.6.0 up to but not including 0.33.0.0.33.0fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.