Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
pdfMake
✓ import * as pdfMake from 'pdfmake/build/pdfmake';
✗ const pdfMake = require('pdfmake');
Since v0.3.0, pdfmake is primarily designed for ES Modules and uses a promise-based API. The recommended import path for both Node.js and browser environments often targets the `build/pdfmake` file explicitly, as shown in official documentation. Attempting to use `require()` will likely fail in modern setups.
pdfFonts
✓ import * as pdfFonts from 'pdfmake/build/vfs_fonts';
✗ import { vfs_fonts } from 'pdfmake';
Font definitions (`vfs_fonts`) are crucial for pdfmake to render text. They are typically imported separately and assigned to `pdfMake.vfs`. Incorrectly importing or omitting font definitions will lead to rendering issues.
setUrlAccessPolicy
✓ pdfMake.setUrlAccessPolicy((url) => { /* ... */ });
This method is directly available on the `pdfMake` object for configuring URL access for external resources (e.g., images). It should be called before generating PDFs that might fetch external content.
This quickstart demonstrates how to generate a PDF file using pdfmake in a Node.js environment, showcasing basic text, lists, tables, styles, and the promise-based API. It also includes the crucial step of assigning font definitions and setting a URL access policy.
import * as pdfMake from 'pdfmake/build/pdfmake';
import * as pdfFonts from 'pdfmake/build/vfs_fonts';
import * as fs from 'fs'; // For Node.js file system operations
// Assign fonts (crucial for pdfmake to work)
pdfMake.vfs = pdfFonts.pdfMake.vfs;
// Define an optional URL access policy for external images/resources
// This is critical since v0.3.6 (CVE-2026-26801 fix)
pdfMake.setUrlAccessPolicy((url) => {
// Only allow access to URLs from example.com
return url.startsWith("https://example.com/");
});
const docDefinition = {
content: [
{ text: 'Hello, pdfmake!', style: 'header' },
'This is an example PDF generated using pdfmake version 0.3.7.',
{ text: 'Features showcased:', margin: [0, 15, 0, 5] },
{
ul: [
'Structured content with text and lists.',
'Basic styling with custom font sizes and bold text.',
'Uses the modern promise-based API for generation.'
]
},
{ text: 'A small table:', style: 'subheader', margin: [0, 15, 0, 5] },
{
table: {
headerRows: 1,
widths: ['*', 'auto', 100],
body: [
['Column 1', 'Column 2', 'Column 3'],
['One value', 'Another value', 'Some more text'],
[{ text: 'Complex cell with span', colSpan: 2 }, {}, 'Last cell']
]
}
}
],
styles: {
header: { fontSize: 22, bold: true, alignment: 'center', margin: [0, 0, 0, 20] },
subheader: { fontSize: 16, bold: true }
},
defaultStyle: {
font: 'Roboto' // Ensure a font is available, Roboto is default via vfs_fonts
}
};
async function generatePdf() {
try {
const pdfDoc = pdfMake.createPdf(docDefinition);
const buffer = await pdfDoc.getBuffer();
fs.writeFileSync('output.pdf', buffer);
console.log('PDF generated successfully: output.pdf');
} catch (error) {
console.error('Error generating PDF:', error);
}
}
generatePdf();
Debug
Known issues
breakingVersion 0.3.0 introduced significant breaking changes, including dropping support for Internet Explorer 11, requiring Node.js 20 LTS or newer, porting the codebase to ES6+, unifying the interface for Node.js and browser, and changing all methods to return Promises instead of using callbacks.fixUpdate Node.js to >=20. Rewrite code to use ES6+ syntax and `async/await` or `.then()` for all API calls (e.g., `pdfDoc.getBuffer().then(...)` instead of `pdfDoc.getBuffer((buffer) => {...})`). Remove IE11 compatibility code. affects: >=0.3.0
breakingThe way virtual font storage is included, especially on the client-side, changed significantly in v0.3.0. This can affect how fonts are loaded and made available to pdfmake.fixEnsure `pdfMake.vfs = pdfFonts.pdfMake.vfs;` is properly set up after importing `pdfmake` and `vfs_fonts`. Consult the official documentation for specific font embedding strategies for your environment (client-side vs. server-side).
affects: >=0.3.0
gotchaA potential server vulnerability (CVE-2026-26801) was addressed in v0.3.6. For security reasons, pdfmake now requires defining a custom URL access policy using `pdfMake.setUrlAccessPolicy()` for any external URLs (e.g., for images) before they can be downloaded and used in PDFs.fixImplement `pdfMake.setUrlAccessPolicy((url) => { /* return true for allowed URLs */ });` to explicitly whitelist domains or protocols from which external resources can be loaded. Failure to do so will result in errors when trying to use external URLs. affects: >=0.3.6
gotchaSVG validation was enhanced in versions 0.2.23 and 0.3.2. SVG elements used in your document definition must explicitly specify `width` and `height` properties, either within the SVG string/element itself or in the `svg` node properties.fixEnsure all SVG assets have defined `width` and `height` attributes (e.g., `<svg width="100" height="50">...</svg>`) or provide these properties in the pdfmake document definition for the `svg` node.
affects: >=0.2.23, >=0.3.2
Errors
Common errors & fixes
ReferenceError: require is not defined
Attempting to use CommonJS `require()` syntax in an ES Module context after pdfmake v0.3.0 transitioned to ES6+.
fixChange your import statements to use ES Modules syntax: `import * as pdfMake from 'pdfmake/build/pdfmake';`.
TypeError: pdfMake.createPdf(...).getBuffer is not a function (or similar 'callback is not a function')
Using the old callback-based API (`getBuffer((buffer) => {})`) with pdfmake versions 0.3.0 or higher, which now use a promise-based API.
fixUpdate your code to use the promise-based API: `const pdfDoc = pdfMake.createPdf(docDefinition); const buffer = await pdfDoc.getBuffer();` or `pdfDoc.getBuffer().then(buffer => ...);`.
Error: SVG must have width and height specified
An SVG image in the document definition is missing explicit `width` and `height` attributes, which are now strictly validated.
fixEnsure all SVG strings or `svg` nodes in your document definition include defined `width` and `height` properties.
Error: Unauthorized URL access: [URL]
Attempting to use an external URL for an image or resource without configuring a URL access policy after the v0.3.6 update.
fixSet a URL access policy using `pdfMake.setUrlAccessPolicy((url) => url.startsWith('https://your-allowed-domain.com/'));` before creating the PDF, allowing only trusted URLs. Audit
Dependencies
pdfkitrequiredCore PDF generation engine that pdfmake builds upon. Reverted to the original pdfkit package in v0.3.0.
svg-to-pdfkitrequiredUsed for converting SVG content into PDF-compatible elements.