CVE-2025-11362: pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding

The vulnerability is a resource exhaustion issue within the pdfmake library, specifically in how it handles HTTP redirects when embedding remote files. By analyzing the provided security patch, I was able to pinpoint the exact location of the vulnerability.

The commit 741169634bf07730e010cd77477b6cc038e846ed directly addresses the problem. The changes are concentrated in the src/URLResolver.js file, specifically within the fetchUrl function. Before the patch, this function would recursively follow any URL specified in the Location header of a 3xx redirect response. It did not track how many redirects had occurred.

This created a classic scenario for a Denial of Service attack. A malicious actor could set up a web server that responds with an infinite chain of redirects. When pdfmake attempts to embed a file from this malicious URL, the fetchUrl function would be called repeatedly, consuming system resources with each call until the application crashes.

The fix is straightforward: it introduces a counter (redirectCount) and a maximum limit (MAX_REDIRECTS). The fetchUrl function now tracks the number of redirects and will abort the process if the limit is exceeded, thus preventing the infinite recursion and the resulting resource exhaustion. Therefore, the fetchUrl function is the vulnerable function that would appear in a runtime profile during exploitation.