CVE-2026-115729 Details
Description
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
A server-side request forgery (SSRF) vulnerability has been identified in the @pdfme/common package, affecting versions 5.5.10 prior to 6.2.6. The vulnerability allows attackers to bypass the 'isUrlSafeToFetch' denylist in the 'getB64BasePdf' function. Exploitation involves supplying 'basePdf' URLs that utilize IPv4-mapped IPv6, '[::]', NAT64, or localhost alias hostnames. This manipulation can lead to unauthorized access to loopback, internal, or cloud metadata responses, which are then embedded in generated documents.
Users can update to version 6.2.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6 | [email protected] | Source CodeVendor |
| https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @pdfme/common | >= 5.5.10, < 6.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |