CVE-2026-65842 in @platejs/docx-io (htmlToDocxBlob) is an SSRF vulnerability where the HTML-to-DOCX conversion silently fetches remote resources referenced in attacker-controlled HTML. When this function runs server-side—a common pattern in document automation workflows—it performs HTTP requests to arbitrary URLs without the developer realizing network I/O is occurring. This is the core risk: the abstraction makes the fetch invisible, so a developer converting user-submitted HTML to a DOCX report has no indication their server is making outbound requests on their infrastructure's behalf.
The vulnerability has two exploitation vectors. First, internal reconnaissance: an attacker submits HTML referencing internal URLs (e.g., http://internal-api:8080/admin) and can probe whether those resources exist and respond. Second, DoS amplification: the attacker points the conversion at large or numerous images, forcing your server to spam target endpoints with requests—an amplification factor that makes your infrastructure the weapon.
Check your deployments immediately. Search for any code path where htmlToDocxBlob processes untrusted HTML server-side, particularly in document generation services, report builders, or any workflow converting user input to DOCX. If you find it, verify you're on version 53.3.2 or later. The patch modifies the fetch behavior—ensure your integration doesn't depend on automatic remote image embedding that the fix may have altered.
The deeper concern is the integration pattern: this module lives in a component library (@platejs/docx-io), meaning security reviews of the core editor wouldn't surface this attack surface. Audit your dependency trees for document-processing modules handling untrusted input, not just the main application code. Organizations running containerized or pinned dependencies should treat this with higher urgency—rapid release velocity means vulnerable versions may persist in Docker images and frozen graphs that won't auto-update.