BentoPDF’s cors‑proxy-worker.js contains a server‑side request forgery flaw. The proxy validates a supplied hostname with isPrivateOrReservedHost() before performing a fetch. The validation is independent of the DNS resolution used by fetch(targetUrl), enabling an attacker to supply a hostname that passes the allow‑list check yet resolves to an internal or reserved destination after fetch. Successful exploitation lets an attacker retrieve up to a 10 MB response from any reachable server, including internal infrastructure and services that should not be exposed to the public internet. The flaw also permits manipulation of the Origin header for browser‑directed clients, potentially leaking private information through responses that would normally be protected by the browser’s same‑origin policy.

Any deployment of BentoPDF 2.8.6 or earlier, whether using the official Cloudflare‑based worker or a self‑hosted instance, is affected, provided the worker’s execution environment can reach internal or reserved networks. The problem arises in both client‑side and server‑side deployments, and replacement certificates or timestamp proxies that rely on the same cors‑proxy are included.

The vulnerability is classified with a CVSS score of 8.6, indicating high severity. EPSS is not available, and the defect is not listed in CISA’s KEV catalog, but the lack of an official restriction on target addresses means that the attack is feasible if the worker can resolve internal or reserved names. Exploitation requires an attacker to supply a malicious hostname and orchestrate a request via the cors‑proxy, possibly leveraging forged Origin headers when the client has a browser reference. Deployments that omit PROXY_SECRET lose an additional anti‑abuse check, increasing risk for unauthenticated request exploitation. Once exploited, an attacker can exfiltrate data or use the proxy to pivot within the internal network.