CVE-2026-65842: CWE-918: Server-Side Request Forgery (SSRF) in udecode plate

The vulnerability CVE-2026-65842 affects the udecode plate rich-text editor before version 53.3.2. The @platejs/docx-io module fetches remote images referenced in attacker-controlled HTML during the htmlToDocxBlob conversion process on the server or privileged environment. This behavior enables server-side request forgery (SSRF), allowing attackers to induce the server to make HTTP requests to internal or external resources. The fetched image bytes are included in the generated DOCX file, which can disclose the content of internal network responses. Additionally, attackers can cause resource consumption by selecting large or slow remote responses. The vulnerability is addressed by updating to version 53.3.2.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal network resources, potentially disclosing sensitive internal data via the included image bytes in DOCX files. The vulnerability also allows attackers to cause resource exhaustion by forcing the server to fetch large or slow remote responses. This can lead to information disclosure and denial-of-service conditions. The CVSS score is 8.2 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality impact, no integrity impact, and low availability impact.

Upgrade to udecode plate version 53.3.2 or later, where this SSRF vulnerability is fixed. No additional mitigation steps are required once the update is applied.