Skip to main content
cve.nowby Sazabi
← npm
npmPackage

pdfjs-dist

2 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
6.5.438 (Nov 1, 2026): no advisory affects it
Newest unaffected release
6.5.438 (Nov 1, 2026), the latest release
Advisories
2 · 1 medium
Weekly downloads
50.4M
Releases
500+ since 1.8.280 (Apr 28, 2017)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2024-4367
    Affects 1.8.280 to 4.1.392 (4.2.67 is outside it)
  • CVE-2018-5158
    Affects 1.8.280 to 1.10.97 (1.10.100 is outside it); 2.0.87 to 2.0.489 (2.0.550 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • CVE-2024-4367Medium 5.6

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

    Affected: fixed in 4.2.67.

    Fixed in 4.2.67 (released Apr 29, 2024, 15 days before disclosure).

    The latest release, 6.5.438, is not affected.

    6.4% of pdfjs-dist downloads last week were affected versions (3.7M).

  • The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a…

    Affected: from 2.0.0, fixed in 2.0.550; fixed in 1.10.100.

    Fixed in 1.10.100 (released Jun 6, 2018, 5 days before disclosure) and 2.0.550 (released Jun 6, 2018, 5 days before disclosure).

    The latest release, 6.5.438, is not affected.

    0.1% of pdfjs-dist downloads last week were affected versions (61.6K).