Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash …

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-11362 · Microsoft / collected KEV context

EUVD-2025-31879

GHSA-rj3r-r7hh-jxfq

cve-program · CVE-2025-11362

• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed

euvd · EUVD-2025-31879

• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed

nvd · CVE-2025-11362

• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887
• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297

osv · GHSA-rj3r-r7hh-jxfq

• https://nvd.nist.gov/vuln/detail/CVE-2025-11362
• https://github.com/bpampuch/pdfmake/issues/2886
• https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed
• https://github.com/bpampuch/pdfmake
• https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297

No related operational record is retained in the current change model.