The pdfmake library contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to crash the application, posing a significant threat to service availability.

This is a resource exhaustion flaw categorized as CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated attacker can trigger this vulnerability by providing crafted input containing repeatedly redirected URLs during the file embedding process, forcing the application to consume excessive resources.

The primary risk associated with this vulnerability is a denial of service, which can lead to application crashes and significant downtime for systems relying on pdfmake for document generation. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent operational disruption and maintain service level agreements, as the vulnerability is remotely exploitable without authentication.

Immediate Action: Update the npm package pdfmake to version 0.3.0-beta.17 or later, or update the org.webjars.npm:pdfmake dependency to 0.3.0-beta.18 or later to incorporate the necessary resource limit fixes.

Proactive Monitoring: Monitor application server logs for frequent crashes or unusual spikes in memory and CPU usage that correlate with document generation requests.

Compensating Controls: Implement input validation on the server side to restrict the types of URLs accepted during document generation and utilize rate limiting on endpoints that process external file embeddings.

Public Exploit Available: No (exploit_available is false/unknown).

Given the potential for complete service interruption, administrators should prioritize updating the pdfmake dependency to the specified patched versions. Failure to remediate this flaw exposes the application to trivial denial of service attacks, which could be leveraged to disrupt critical business workflows.