CVE-2026-102354

medium

Assigned by CNA: github_m

Published 2026-10-14 · Modified 2026-10-14

Discuss on Community Propose mitigation

CVSS v3

6.8

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.8

Description

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.

Predictions

Exploit likelihood

77%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

References

CWEs

CWE-367 CWE-918

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.