CVE-2025-54869: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

August 5, 2025 (updated November 10, 2025)

This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability.

References

github.com/Setasign/FPDI
github.com/Setasign/FPDI/commit/ba671ba9221cffd32c2dda87316c19f522a1c5f0
github.com/Setasign/FPDI/security/advisories/GHSA-jxhh-4648-vpp3
github.com/advisories/GHSA-jxhh-4648-vpp3
nvd.nist.gov/vuln/detail/CVE-2025-54869

Code Behaviors & Features

Detect and mitigate CVE-2025-54869 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →