CVE-2025-11362

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-07 · updated 2026-10-19
Weakness: CWE-770

Description

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

Affected products

bpampuch pdfmake: 0.3.0-beta1, 0.3.0-beta10, 0.3.0-beta11, 0.3.0-beta12, 0.3.0-beta13, 0.3.0-beta14 (+10)

References

https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297

Get alerted when CVE-2025-11362 or the next vulnerability affects your stack