CVE-2026-26801: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26801 is a Server-Side Request Forgery (SSRF) vulnerability in the pdfmake JavaScript library, affecting versions 0.3.0-beta.2 through 0.3.5. The flaw resides in the src/URLResolver.js component, which fetches external URLs without enforcing any access policy, allowing a remote unauthenticated attacker to cause the server to make arbitrary HTTP requests and obtain sensitive information. It was published on March 10, 2026, with the fix released the same day in version 0.3.6 (Feedly, pdfmake Release). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from the absence of any URL access control policy in the URLResolver.js component's fetchUrl() function (pdfmake URLResolver). When pdfmake is used server-side to generate PDFs, it resolves image or resource URLs supplied in document definitions by fetching them directly via HTTP/HTTPS without validating whether the target URL is permitted. An attacker who can influence the document definition (e.g., by supplying a crafted image URL pointing to http://169.254.169.254/ or internal services) can cause the server to fetch arbitrary internal or external resources. No authentication or special privileges are required, and the attack is conducted entirely over the network (Feedly, pdfmake PR #2920).

Successful exploitation allows an unauthenticated remote attacker to make the pdfmake server fetch arbitrary URLs, exposing sensitive information from internal systems reachable by the server — including cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-public services (Feedly). The primary impact is a high confidentiality loss (credentials, tokens, internal data), with no direct integrity or availability impact. In cloud environments, credential theft via metadata service access could enable lateral movement and full account compromise (PoC).

A public proof-of-concept exploit is available, consisting of four runnable Node.js scripts (vulnerable-server.js, mock-metadata-server.js, attack.js, attack-exfiltration.js) that demonstrate both blind SSRF and full-read SSRF with credential exfiltration from a mock AWS metadata server (PoC). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made (Feedly). The EPSS score is approximately 0.043%, indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify applications that use pdfmake server-side (versions 0.3.0-beta.2 through 0.3.5) to generate PDFs from user-supplied or partially user-controlled document definitions. Look for endpoints that accept JSON document definitions or image URLs.
2. Craft malicious document definition: Prepare a pdfmake document definition JSON that includes an image element with a url field pointing to a target internal resource, such as the AWS EC2 metadata endpoint: { "content": [{ "image": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" }] }.
3. Submit the payload: Send the crafted document definition to the vulnerable server endpoint that invokes pdfmake's PDF generation. The server's URLResolver.js will call fetchUrl() with the attacker-supplied URL without any access policy check.
4. Retrieve sensitive data: The server fetches the internal URL and embeds the response content (e.g., IAM role credentials, internal API responses) into the generated PDF or returns an error that leaks data. The attacker retrieves the PDF or monitors out-of-band channels to collect the exfiltrated information.
5. Escalate (optional): Use harvested cloud credentials or internal service tokens to authenticate to cloud management APIs, enabling lateral movement or privilege escalation within the target environment (PoC, Feedly).

• Network: Outbound HTTP/HTTPS requests from the application server to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16) or unexpected external hosts, initiated by the Node.js/pdfmake process.
• Network: Requests to cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ or http://100.100.100.200/ (Alibaba Cloud) originating from the PDF generation service.
• Logs: Application or web server logs showing PDF generation requests containing image URLs pointing to internal addresses or metadata services.
• Logs: Node.js application logs showing pdfmake warnings about undefined URL access policy (introduced in version 0.3.6 as a detection aid for misconfigured deployments).
• Process: Unusual outbound network connections from the Node.js process to non-standard destinations during PDF generation operations.

Upgrade pdfmake to version 0.3.6 or later, which introduces the setUrlAccessPolicy() method that allows server operators to define and enforce URL allowlists (pdfmake Release, pdfmake PR #2920). After upgrading, configure the policy explicitly — for example: pdfmake.setUrlAccessPolicy((url) => url.startsWith('https://example.com/')); — to restrict which URLs the library is permitted to fetch. As a network-level workaround, implement egress firewall rules on the application server to block outbound connections to internal IP ranges and cloud metadata endpoints. Version 0.3.6 also logs a warning when pdfmake is used server-side without a policy configured, aiding detection of misconfigured deployments (Feedly).

The fix was merged by pdfmake maintainer liborm85 on March 10, 2026, the same day the CVE was published, indicating a coordinated disclosure (pdfmake PR #2920). A security researcher published a detailed PoC repository with a full attack chain demonstration including credential exfiltration from a mock AWS metadata server (PoC). Community coverage appeared on Mastodon and threat intelligence aggregators shortly after disclosure, and a blog post titled "The 70 Ways a Single PDF Can Hack Your Network" referenced the vulnerability in the context of malicious PDF generator risks.