CVE-2026-119204: CVE-2026-119204: Uncontrolled Resource Consumption in pypdf Page Tree Flattening

Two vulnerabilities were reported on 2026-10-30. CVE-2026-118773 affects node-glob versions 9.0.0 to 14.0.1, where missing return statements in AbortSignal routines allow background filesystem reads to continue after operation rejection. Simultaneously, CVE-2026-119204 impacts pypdf versions prior to 6.21.4. This Denial of Service vulnerability occurs during PDF page tree flattening, allowing unauthenticated attackers to use hierarchical amplification structures to force the copying of millions of dictionary entries into PageObject instances, causing uncontrolled resource consumption.