Riskcovery

CVE-2025-11362

State
Published
Severity
8.7 High
Published
Oct 7, 2025
Updated
Aug 15, 2026
Reserved
Oct 6, 2025

Read the record on cve.org

Description

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nsnyk
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsnyk

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
pdfmaken/a
  • 0.3.0-beta.1 to before 0.3.0-beta.17Affected
org.webjars.npm:pdfmaken/a
  • 0.3.0-beta.1 to before 0.3.0-beta.18Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.