CVE-2025-11362 json
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding
published last yr. modified 23d ago also GHSA-rj3r-r7hh-jxfq , EUVD-2025-31879
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
Patch / fix
- npm pdfmake 0.3.0-beta.17
- n/a pdfmake 0.3.0-beta.17
- n/a org.webjars.npm:pdfmake 0.3.0-beta.18
Is CVE-2025-11362 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | pdfmake | >=0.3.0-beta.1, <0.3.0-beta.17 |
0.3.0-beta.17 |
Affected products
- n/a pdfmake
- n/a org.webjars.npm:pdfmake
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed
web, patch
-
security.snyk.io
/vuln/SNYK-JS-PDFMAKE-10223297
web, third-party-advisory
- security.snyk.io /vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
-
nvd.nist.gov
/vuln/detail/CVE-2025-11362
advisory
-
github.com
/bpampuch/pdfmake/issues/2886
web
-
github.com
/bpampuch/pdfmake
package
Sources
- CVE List CVE-2025-11362
- GitHub Advisory GHSA-rj3r-r7hh-jxfq
- NVD CVE-2025-11362
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.