Vulnerabilities in pkg:npm/ngx-extended-pdf-viewer

PACKAGE
Share
Advisory Summary

GHSA-w9hm-4m3m-fxmm is a HIGH ngx-extended-pdf-viewer bundles a version of vulnerability (CWE-1103: Use of Platform-Dependent Third Party Components) affecting Ngx extended pdf viewer libraries in the npm ecosystem. The issue involves ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to cve-2026-16633. Remediation is available by upgrading affected packages to version 29.0.0-rc.3.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/ngx-extended-pdf-viewer

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/ngx-extended-pdf-viewer. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-w9hm-4m3m-fxmm - HIGH ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

GHSA-w9hm-4m3m-fxmm at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-w9hm-4m3m-fxmm
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-1103: Use of Platform-Dependent Third Party Components
Affected Product Ngx extended pdf viewer
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-w9hm-4m3m-fxmm

To remediate this vulnerability, upgrade all affected Ngx extended pdf viewer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ngx-extended-pdf-viewer fixed: 29.0.0-rc.3 
npm install ngx-extended-pdf-viewer@29.0.0-rc.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls ngx-extended-pdf-viewer

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-w9hm-4m3m-fxmm, inspect your project dependencies using npm:

npm ls ngx-extended-pdf-viewer

Analyze the terminal output to locate any version of Ngx extended pdf viewer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 29.0.0-rc.3), your application is affected.

Note: The npm ls ngx-extended-pdf-viewer command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1103: Use of Platform-Dependent Third Party Components, where the product relies on third-party components that do not provide equivalent functionality across all desirable platforms. In Ngx extended pdf viewer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. ### Impact Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633. ### Exposure. The sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not — so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe. ### Patches 29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates. ### Workarounds Set pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src. ### Verifying. From 29.0.0 the package ships sbom.json and vex.json. The SBOM records the applied fix as a CycloneDX pedigree.patches entry; the VEX carries a resolved_with_pedigree statement so scanners stop flagging the engine's nominal version.

GHSA-w9hm-4m3m-fxmm Affected Ngx extended pdf viewer Versions

1 component(s)
Fixed Versions:
29.0.0-rc.3
Product / Package Ecosystem Affected Versions Fixed Version
ngx-extended-pdf-viewer
npm/ngx-extended-pdf-viewer
npm
≥ 27.0.0-rc.0
< 29.0.0-rc.3
29.0.0-rc.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/stephanrauh/ngx-extended-pdf-viewer/security/advisories/GHSA-w9hm-4m3m-fxmm
Ngx extended pdf viewer Source Repository REPOSITORY
https://github.com/stephanrauh/ngx-extended-pdf-viewer

Frequently Asked Questions

What is GHSA-w9hm-4m3m-fxmm?
GHSA-w9hm-4m3m-fxmm is a security vulnerability in Ngx extended pdf viewer involving ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 under CWE-1103: Use of Platform-Dependent Third Party Components.
Which Ngx extended pdf viewer versions are affected?
Affected versions include releases prior to 29.0.0-rc.3 across affected packages: ngx-extended-pdf-viewer.
What version fixes GHSA-w9hm-4m3m-fxmm?
Upgrading to 29.0.0-rc.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is ngx-extended-pdf-viewer affected?
Yes, ngx-extended-pdf-viewer is affected in releases prior to 29.0.0-rc.3. Upgrade your dependency to 29.0.0-rc.3 or later.
What CWE is associated with GHSA-w9hm-4m3m-fxmm?
GHSA-w9hm-4m3m-fxmm is classified under CWE-1103: Use of Platform-Dependent Third Party Components (The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.).
How can I check npm dependencies for GHSA-w9hm-4m3m-fxmm?
Run the dependency tree command: 'npm ls ngx-extended-pdf-viewer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w9hm-4m3m-fxmm",
  "modified" : "2026-08-06T21:13:59Z",
  "published" : "2026-08-06T21:13:59Z",
  "aliases" : [ ],
  "summary" : "ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633",
  "details" : "ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.\n\n### Impact\nOpening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633.\n\n### Exposure. \nThe sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not — so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe.\n\n### Patches\n29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates.\n\n### Workarounds\nSet pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src.\n\n### Verifying. \nFrom 29.0.0 the package ships sbom.json and vex.json. The SBOM records the applied fix as a CycloneDX pedigree.patches entry; the VEX carries a resolved_with_pedigree statement so scanners stop flagging the engine's nominal version.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "ngx-extended-pdf-viewer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "27.0.0-rc.0"
      }, {
        "fixed" : "29.0.0-rc.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/stephanrauh/ngx-extended-pdf-viewer/security/advisories/GHSA-w9hm-4m3m-fxmm"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/stephanrauh/ngx-extended-pdf-viewer"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1103" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-06T21:13:59Z",
    "nvd_published_at" : null
  }
}