Firecrawl’s pdf-inspector takes lopdf fix for stack-overflow DoS

• Firecrawl’s merged change moves the Rust PDF dependency in pdf-inspector from lopdf 0.41.0 to 0.42.0.
• RustSec says versions through 0.41.0 could abort on a roughly 21 KB PDF with a deeply nested object structure.
• The evidence shows a fix on the repository’s main branch, not a released package or a completed rollout to downstream users.

Firecrawl’s public pdf-inspector repository, a Rust-based project for inspecting and extracting PDFs, has merged the upstream lopdf 0.42.0 update for a denial-of-service flaw in the PDF-loading code. The merged commit changes the dependency in both its native and browser WebAssembly configurations. That makes the upstream fix available to builds made from the updated code; it does not by itself show which existing binaries, packages or services have adopted it.

The bug was an abort, not a normal parse error

lopdf is the Rust package that pdf-inspector names in its build configuration and that its PDF-loading path relies on. The RustSec advisory says its Document::load_mem and related load* entry points recursed without a bound while reading nested PDF arrays and dictionaries.

The advisory’s proof of concept is deliberately small: a PDF of about 21 KB with an array roughly 10,380 levels deep in its Catalog. On affected versions, that can exhaust the process stack and end with SIGABRT. RustSec distinguishes that outcome from a Rust panic!: catch_unwind cannot handle the stack-overflow abort. A service that allows an untrusted PDF to reach the affected loader can therefore be taken down by that input.

The advisory record lists lopdf as affected from its initial semver range through 0.41.0, with 0.42.0 as the fixed version. Its remedy is correspondingly bounded: impose a maximum object-nesting depth and return an error instead of recursing without limit.

Firecrawl’s merged diff updates lopdf from 0.41.0 to 0.42.0 in native and browser WebAssembly configurations. .