pdfjs-dist vulnerabilities

Generic build of Mozilla's PDF.js library.

Registry
npm
Latest
6.4.299
License
Apache-2.0
Source
github.com/mozilla/pdf.js (opens the source repository in a new tab)

3 known advisories

The latest version, 6.4.299, is not affected by any of them. Projects on older versions may be.

Update to the latest version:npm install pdfjs-dist@6.4.299

Security advisories for pdfjs-dist

  • HighGHSA-hq66-cqwq-w95j6 Aug 2026

    PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

    Affected
    >=5.6.83 <6.2.108
    Fixed in
    6.2.108
  • HighGHSA-wgrm-67xf-hhpq7 May 2024

    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

    Affected
    <4.2.67
    Fixed in
    4.2.67
  • HighGHSA-7jg2-jgv3-fmr414 May 2022

    Malicious PDF can inject JavaScript into PDF Viewer

    Affected
    >=2.0.0 <2.0.550 · <1.10.100
    Fixed in
    1.10.100, 2.0.550

Which of your client projects still run an old pdfjs-dist?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.