CVE-2025-11362: pdfmake 0.3.0 · update beta1, 0.3.0 · update beta10, 0.3.0 · update beta11 (+14 more affected versions); +1 more…

Affected technology

pdfmake · 0.3.0 · update beta1
pdfmake

pdfmake · 0.3.0 · update beta10
pdfmake

pdfmake · 0.3.0 · update beta11
pdfmake

pdfmake · 0.3.0 · update beta12
pdfmake

pdfmake · 0.3.0 · update beta13
pdfmake

pdfmake · 0.3.0 · update beta14
pdfmake

pdfmake · 0.3.0 · update beta15
pdfmake

pdfmake · 0.3.0 · update beta16
pdfmake

pdfmake · 0.3.0 · update beta2
pdfmake

pdfmake · 0.3.0 · update beta3
pdfmake

pdfmake · 0.3.0 · update beta4
pdfmake

pdfmake · 0.3.0 · update beta5
pdfmake

pdfmake · 0.3.0 · update beta6
pdfmake

pdfmake · 0.3.0 · update beta7
pdfmake

pdfmake · 0.3.0 · update beta8
pdfmake

pdfmake · 0.3.0 · update beta9
pdfmake

pdfmake · 0.3.0-beta.1 to before 0.3.0-beta.17
Vendor not specified by the source

org.webjars.npm:pdfmake · 0.3.0-beta.1 to before 0.3.0-beta.18
Vendor not specified by the source

Description’s affected range: before 0.3.0-beta.17

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.