Summary
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.
Exposure.
The sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not, so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe.
Workarounds
Set pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src.
Verifying.
From 29.0.0 the package ships sbom.json and vex.json. The SBOM records the applied fix as a CycloneDX pedigree.patches entry; the VEX carries a resolved_with_pedigree statement so scanners stop flagging the engine's nominal version.
Impact
Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates.
Frequently Asked Questions
- What is GHSA-W9HM-4M3M-FXMM? GHSA-W9HM-4M3M-FXMM is a high-severity security vulnerability in ngx-extended-pdf-viewer (npm), affecting versions >= 27.0.0-rc.0, < 29.0.0-rc.3. It is fixed in 29.0.0-rc.3.
- Which versions of ngx-extended-pdf-viewer are affected by GHSA-W9HM-4M3M-FXMM? ngx-extended-pdf-viewer (npm) versions >= 27.0.0-rc.0, < 29.0.0-rc.3 is affected.
- Is there a fix for GHSA-W9HM-4M3M-FXMM? Yes. GHSA-W9HM-4M3M-FXMM is fixed in 29.0.0-rc.3. Upgrade to this version or later.
- Is GHSA-W9HM-4M3M-FXMM exploitable, and should I be worried? Whether GHSA-W9HM-4M3M-FXMM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-W9HM-4M3M-FXMM is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-W9HM-4M3M-FXMM? Upgrade
ngx-extended-pdf-viewerto 29.0.0-rc.3 or later.