GHSA-w9hm-4m3m-fxmm: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

August 6, 2026

ngx-extended-pdf-viewer embeds a fork of Mozilla’s pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.

References

github.com/advisories/GHSA-w9hm-4m3m-fxmm
github.com/stephanrauh/ngx-extended-pdf-viewer/security/advisories/GHSA-w9hm-4m3m-fxmm

Code Behaviors & Features

Detect and mitigate GHSA-w9hm-4m3m-fxmm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →