CVE-2025-11362

Summary

CVE	CVE-2025-11362
State	PUBLISHED
Assigner	snyk
Source Priority	CVE Program / NVD first with legacy fallback
Published	2025-10-07 05:15:33 UTC
Updated	2026-10-19 16:10:00 UTC
Description	Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

Risk And Classification

Primary CVSS: v4.0 8.7 HIGH from [email protected]

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.004030000 probability, percentile 0.330830000 (date 2026-08-09)

Problem Types: CWE-770 | CWE-770 Allocation of Resources Without Limits or Throttling | CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling

Version	Source	Type	Score	Severity	Vector
4.0	[email protected]	Secondary	8.7	HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	DECLARED	8.7	HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality

None

Integrity

None

Availability

High

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Pdfmake	Pdfmake	0.3.0	beta1	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta10	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta11	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta12	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta13	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta14	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta15	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta16	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta2	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta3	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta4	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta5	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta6	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta7	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta8	All	All
Application	Pdfmake	Pdfmake	0.3.0	beta9	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	Pdfmake	affected 0.3.0-beta.1 0.3.0-beta.17 semver	Not specified
CNA	Na	Org.webjars.npmpdfmake	affected 0.3.0-beta.1 0.3.0-beta.18 semver	Not specified

References

Reference	Source	Link	Tags
security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297	[email protected]	security.snyk.io	Third Party Advisory
github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed	[email protected]	github.com	Patch
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887	[email protected]	security.snyk.io
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Ryusei Ishikawa (en)

There are currently no legacy QID mappings associated with this CVE.