CVE-2026-102354: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in alam00000 bentopdf

BentoPDF, a privacy-focused PDF toolkit running in the browser, versions before 2.8.7 contain a TOCTOU race condition in cloudflare/cors-proxy-worker.js. The function hostnameResolvesToPrivate() performs a DNS-over-HTTPS safety check separately from the outbound fetch to the target URL. If PROXY_SECRET validation is not enabled, an attacker controlling authoritative DNS can forge the Origin header and supply URLs that pass initial proxy path checks but resolve to private or link-local addresses during the fetch. This discrepancy can allow the attacker to receive allowed response bodies. Exploitation requires precise timing, and certain mitigations like blocking redirects and IP-literal obfuscation, as well as network reachability constraints, reduce the risk. The issue is resolved in BentoPDF version 2.8.7.

Successful exploitation can allow an attacker to bypass DNS resolution safety checks and retrieve response bodies from private or link-local network addresses that should be inaccessible. This can lead to unauthorized data disclosure. However, exploitation is constrained by the need for precise timing, network reachability, and other mitigations. The vulnerability does not impact integrity or availability.

A patch is available and the vulnerability is fixed in BentoPDF version 2.8.7. Users should upgrade to version 2.8.7 or later. Since BentoPDF is a cloud-hosted service, the vendor manages remediation for this service. Check the vendor advisory for confirmation and ensure PROXY_SECRET validation is enabled to mitigate the risk.