GHSA-w9hm-4m3m-fxmm
GHSA-w9hm-4m3m-fxmm is a security vulnerability in ngx-extended-pdf-viewer. O3 Security confirms whether GHSA-w9hm-4m3m-fxmm is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
ngx-extended-pdf-viewernpmDescription
ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.
Impact
Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream advisory: GHSA-hq66-cqwq-w95j / CVE-2026-16633.
Exposure.
The sandbox half of the issue requires enableScripting, which pdf.js enables by default but this library does not — so the default configuration was less exposed than upstream's. The other half concerns XFA rich text and is reachable whenever enableXfa is true, which is the default here. Do not assume the default configuration was safe.
Patches
29.0.0-rc.3 cherry-picks Mozilla's fix (pdf.js 6.2.108) into both the stable and bleeding-edge engines. Only the latest release receives security updates.
Workarounds
Set pdfDefaultOptions.enableXfa = false if you do not need XFA forms, and/or apply a CSP disallowing inline script-src.
Verifying.
From 29.0.0 the package ships sbom.json and vex.json. The SBOM records the applied fix as a CycloneDX pedigree.patches entry; the VEX carries a resolved_with_pedigree statement so scanners stop flagging the engine's nominal version.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | ngx-extended-pdf-viewer | ≥ 27.0.0-rc.0&&< 29.0.0-rc.3 | 29.0.0-rc.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ngx-extended-pdf-viewer. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update ngx-extended-pdf-viewer to 29.0.0-rc.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w9hm-4m3m-fxmm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-w9hm-4m3m-fxmm is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-w9hm-4m3m-fxmm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-w9hm-4m3m-fxmm in your dependencies?
O3 detects GHSA-w9hm-4m3m-fxmm across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.