The vulnerability is an unbounded buffer growth in the DecodeStream.ensureBuffer() method, leading to denial of service when parsing FlateDecode streams with decompression bombs. Attackers can supply a small compressed PDF that expands to hundreds of megabytes, exhausting memory and crashing the Node.js process or freezing browser tabs during PDF parsing. The weakness is CWE-409.

The affected product is pdfme’s pdf-lib library. All released versions prior to 5.5.10 are vulnerable; no other version information is available. Deployments that rely on pdf-lib for PDF rendering or processing are potentially impacted.

The CVSS score of 7.1 classifies the issue as high, indicating that memory exhaustion can lead to significant availability disruption. While the EPSS score is not available, the technique of a decompression bomb is a well‑known denial‑of‑service exploitation method. An attacker can trigger the failure simply by transmitting a crafted PDF to an application that uses pdf-lib for parsing, whether on a Node.js server or within a browser. The vulnerability is not currently listed in CISA’s KEV catalog, but the high impact mandates prompt mitigation.