# pdfjs-dist (npm) vulnerabilities

2 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 6.5.438 (Nov 1, 2026): no advisory affects it
- Newest unaffected release: 6.5.438 (Nov 1, 2026), the latest release
- Weekly downloads: 50.4M
- Releases: 500+ since 1.8.280 (Apr 28, 2017)
- Registry: https://www.npmjs.com/package/pdfjs-dist
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2024-4367: 1.8.280 to 4.1.392 (4.2.67 is outside it)
- CVE-2018-5158: 1.8.280 to 1.10.97 (1.10.100 is outside it); 2.0.87 to 2.0.489 (2.0.550 is outside it)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (2)

### [CVE-2024-4367](https://cve.now/CVE-2024-4367): A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

- Severity: Medium 5.6
- Published: May 14, 2024
- Affected: fixed in 4.2.67.
- Fixed in 4.2.67 (released Apr 29, 2024, 15 days before disclosure).
- The latest release, 6.5.438, is not affected.
- 6.4% of pdfjs-dist downloads last week were affected versions (3.7M).

### [CVE-2018-5158](https://cve.now/CVE-2018-5158): The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a…

- Severity: Unrated
- Published: Jun 11, 2018
- Affected: from 2.0.0, fixed in 2.0.550; fixed in 1.10.100.
- Fixed in 1.10.100 (released Jun 6, 2018, 5 days before disclosure) and 2.0.550 (released Jun 6, 2018, 5 days before disclosure).
- The latest release, 6.5.438, is not affected.
- 0.1% of pdfjs-dist downloads last week were affected versions (61.6K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/pdfjs-dist
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.