HTTP Request Smuggling Affecting ngx-extended-pdf-viewer package, versions >=27.0.0-rc.4 <29.0.0-rc.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NGXEXTENDEDPDFVIEWER-18593789
- published8 Aug 2026
- disclosed6 Aug 2026
- creditcalixteman
Introduced: 6 Aug 2026
New CVE NOT AVAILABLE CWE-444 (opens in a new tab)How to fix?
Upgrade ngx-extended-pdf-viewer to version 29.0.0-rc.3 or higher.
Overview
ngx-extended-pdf-viewer is a powerful, full-featured PDF viewer for Angular applications. Whether you're building enterprise tools or internal utilities, this library gives you the control and customization options you need, all while preserving a native-like viewing experience.
Built on Mozilla’s pdf.js and extended with dozens of enhancements, it's ideal for serious applications that demand more than just basic PDF display.
Affected versions of this package are vulnerable to HTTP Request Smuggling through the processing of PDF files containing XFA rich text when enableXfa is set to true. An attacker can execute arbitrary JavaScript code in the context of the hosting page by enticing a user to open a specially crafted PDF file. This is only exploitable if pdfDefaultOptions.enableXfa is enabled, which is true by default.
Workaround
This vulnerability can be mitigated by setting pdfDefaultOptions.enableXfa to false and/or applying a Content Security Policy (CSP) that disallows inline script sources.