CVE-2026-125107

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

• CWE-476

• https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b
• https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12510The AI Engine WordPress plugin before 3.5.5 does not verify…5.9
• CVE-2026-125100FFmpeg through 9.0.2 contains an integer overflow vulnerabil…3.3
• CVE-2026-125101FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125102FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-125103FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125104FFmpeg through 9.0.2 contains a memory exhaustion vulnerabil…5.5
• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3