Vulnerabilities for fpdf2

First version without a known vulnerability: 2.8.8

Details

• GHSA-wqw6-wpr3-45rh2026-10-27

  fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

  Fixed in: 2.8.8

• GHSA-rw7v-4hrq-x6r92026-10-27

  fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

  Fixed in: 2.8.8