CVE-2025-11362

moderate-risk

Published 2025-10-07

Versions of the package pdfmake before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (16)

Pdfmake

Affected Vendors

Pdfmake

References (2)

Patch https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e84...

Third Party Advisory https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 0/34 · Minimal

Exposure 18/34 · Moderate