Packagist/dompdf/dompdf CVE-2026-59942: high 7.5, EPSS 0.90%

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Action: Upgrade dompdf/dompdf to 3.1.6 or later.

composer require dompdf/dompdf:3.1.6

Affected

Fixed versions

Sources

• osv: GHSA-f5gf-2cj8-52g2
• nvd: CVE-2026-59942
• https://github.com/dompdf/dompdf/security/advisories/GHSA-f5gf-2cj8-52g2
• https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0
• https://github.com/dompdf/dompdf/commit/89164eaabe0bb50c462f0b24f740044ba5fb0f99
• https://github.com/dompdf/dompdf
• https://github.com/dompdf/dompdf/releases/tag/v3.1.6

CVE-2026-59942 · published 2026-07-22T22:51:40Z · modified 2026-07-22T23:11:43.942131Z · JSON