GHSA-w9hm-4m3m-fxmm: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

August 6, 2026

ngx-extended-pdf-viewer embeds a fork of Mozilla’s pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.

References

github.com/advisories/GHSA-w9hm-4m3m-fxmm
github.com/stephanrauh/ngx-extended-pdf-viewer/security/advisories/GHSA-w9hm-4m3m-fxmm

Code Behaviors & Features

Detect and mitigate GHSA-w9hm-4m3m-fxmm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →