Vulnerabilities

Vulnerability · CVE-2026-82866

PDFME has SSRF via Unvalidated URL Fetch in When Is Attacker-Controlled

Published Mar 20, 2026 · catalog updated Oct 24, 2026 · PDFME has SSRF via

Last checked Oct 30, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-82866. EPSS is 0.35%. Act only if a listed version of PDFME has SSRF via is installed.

Severity

Medium6.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.35%

Remediation

Advisory link

Affected products

npm @pdfme/common

## Summary The function in fetches arbitrary URLs via without any validation when is a non-data-URI string and is defined. An attacker who can control the field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts. ## Details The vulnerability exists in . When receives a string that does not start with , and is defined, it passes the string directly to : The Zod schema for in accepts any string: The function at only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline. This function is called from multiple entry points: - — during PDF generation - — during UI rendering - — during template processing The guard is commonly satisfied in SSR environments (Next.js, Nuxt with jsdom, Cloudflare Workers) where is polyfilled but has full network access without CORS restrictions. ## PoC ### 1. Setup a vulnerable application ### 2. Probe internal services via SSRF ### 3. Port scanning internal network ### 4. Exfiltrate cloud metadata (AWS example) ## Impact - **Cloud metadata exfiltration**: In SSR deployments on AWS/GCP/Azure, attackers can reach instance metadata endpoints ( ) to steal IAM credentials, API tokens, and service account keys. - **Internal network reconnaissance**: Attackers can probe internal services, discover open ports, and map network topology by observing response timing and error differences. - **Internal service access**: Requests to internal APIs (databases, caches, admin panels) that are not exposed to the internet but accessible from the server. - **Blind request forgery in browsers**: Even with CORS restrictions limiting response reading, attackers can trigger state-changing requests to internal services (GET-based acti