AIKIDO-2026-990697
pdfjs-dist is vulnerable to Denial of Service (DoS)
43
Medium Risk
This Affects:
pdfjs-distTL;DR
PDF.js computes an automatic font size for AcroForm text fields by repeatedly re-measuring and shrinking the font until the text fits the field, with no bound on the number of iterations or on the size of the field content. A PDF containing an auto-sized text field with large content lets this fitting loop run for an extended period, consuming excessive CPU while the document is simply rendered or viewed (bug 2069428). The fix caps the auto-size font computation so it can no longer run unbounded.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render a PDF containing an AcroForm text field configured for automatic font sizing.
Background info
pdfjs-dist is vulnerable to Denial of Service (DoS) in versions 2.13.216 - 6.3.289.
How to fix this
Upgrade the pdfjs-dist library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.