pdfmake

Common errors

• ReferenceError: require is not defined

  cause Attempting to use CommonJS `require()` syntax in an ES Module context after pdfmake v0.3.0 transitioned to ES6+.
  fix Change your import statements to use ES Modules syntax: `import * as pdfMake from 'pdfmake/build/pdfmake';`.

• TypeError: pdfMake.createPdf(...).getBuffer is not a function (or similar 'callback is not a function')

  cause Using the old callback-based API (`getBuffer((buffer) => {})`) with pdfmake versions 0.3.0 or higher, which now use a promise-based API.
  fix Update your code to use the promise-based API: `const pdfDoc = pdfMake.createPdf(docDefinition); const buffer = await pdfDoc.getBuffer();` or `pdfDoc.getBuffer().then(buffer => ...);`.

• Error: SVG must have width and height specified

  cause An SVG image in the document definition is missing explicit `width` and `height` attributes, which are now strictly validated.
  fix Ensure all SVG strings or `svg` nodes in your document definition include defined `width` and `height` properties.

• Error: Unauthorized URL access: [URL]

  cause Attempting to use an external URL for an image or resource without configuring a URL access policy after the v0.3.6 update.
  fix Set a URL access policy using `pdfMake.setUrlAccessPolicy((url) => url.startsWith('https://your-allowed-domain.com/'));` before creating the PDF, allowing only trusted URLs.

Warnings

• breaking Version 0.3.0 introduced significant breaking changes, including dropping support for Internet Explorer 11, requiring Node.js 20 LTS or newer, porting the codebase to ES6+, unifying the interface for Node.js and browser, and changing all methods to return Promises instead of using callbacks.
  Fix: Update Node.js to >=20. Rewrite code to use ES6+ syntax and `async/await` or `.then()` for all API calls (e.g., `pdfDoc.getBuffer().then(...)` instead of `pdfDoc.getBuffer((buffer) => {...})`). Remove IE11 compatibility code.
• breaking The way virtual font storage is included, especially on the client-side, changed significantly in v0.3.0. This can affect how fonts are loaded and made available to pdfmake.
  Fix: Ensure `pdfMake.vfs = pdfFonts.pdfMake.vfs;` is properly set up after importing `pdfmake` and `vfs_fonts`. Consult the official documentation for specific font embedding strategies for your environment (client-side vs. server-side).
• gotcha A potential server vulnerability (CVE-2026-26801) was addressed in v0.3.6. For security reasons, pdfmake now requires defining a custom URL access policy using `pdfMake.setUrlAccessPolicy()` for any external URLs (e.g., for images) before they can be downloaded and used in PDFs.
  Fix: Implement `pdfMake.setUrlAccessPolicy((url) => { /* return true for allowed URLs */ });` to explicitly whitelist domains or protocols from which external resources can be loaded. Failure to do so will result in errors when trying to use external URLs.
• gotcha SVG validation was enhanced in versions 0.2.23 and 0.3.2. SVG elements used in your document definition must explicitly specify `width` and `height` properties, either within the SVG string/element itself or in the `svg` node properties.
  Fix: Ensure all SVG assets have defined `width` and `height` attributes (e.g., `<svg width="100" height="50">...</svg>`) or provide these properties in the pdfmake document definition for the `svg` node.

Install

• npm install pdfmake npm
• yarn add pdfmake yarn
• pnpm add pdfmake pnpm

Imports

• pdfMake
  wrong:

  const pdfMake = require('pdfmake');

  correct:

  import * as pdfMake from 'pdfmake/build/pdfmake';

  Since v0.3.0, pdfmake is primarily designed for ES Modules and uses a promise-based API. The recommended import path for both Node.js and browser environments often targets the `build/pdfmake` file explicitly, as shown in official documentation. Attempting to use `require()` will likely fail in modern setups.
• pdfFonts
  wrong:

  import { vfs_fonts } from 'pdfmake';

  correct:

  import * as pdfFonts from 'pdfmake/build/vfs_fonts';

  Font definitions (`vfs_fonts`) are crucial for pdfmake to render text. They are typically imported separately and assigned to `pdfMake.vfs`. Incorrectly importing or omitting font definitions will lead to rendering issues.
• setUrlAccessPolicy

  pdfMake.setUrlAccessPolicy((url) => { /* ... */ });

  This method is directly available on the `pdfMake` object for configuring URL access for external resources (e.g., images). It should be called before generating PDFs that might fetch external content.

Quickstart

This quickstart demonstrates how to generate a PDF file using pdfmake in a Node.js environment, showcasing basic text, lists, tables, styles, and the promise-based API. It also includes the crucial step of assigning font definitions and setting a URL access policy.

import * as pdfMake from 'pdfmake/build/pdfmake';
import * as pdfFonts from 'pdfmake/build/vfs_fonts';
import * as fs from 'fs'; // For Node.js file system operations

// Assign fonts (crucial for pdfmake to work)
pdfMake.vfs = pdfFonts.pdfMake.vfs;

// Define an optional URL access policy for external images/resources
// This is critical since v0.3.6 (CVE-2026-26801 fix)
pdfMake.setUrlAccessPolicy((url) => {
  // Only allow access to URLs from example.com
  return url.startsWith("https://example.com/");
});

const docDefinition = {
  content: [
    { text: 'Hello, pdfmake!', style: 'header' },
    'This is an example PDF generated using pdfmake version 0.3.7.',
    { text: 'Features showcased:', margin: [0, 15, 0, 5] },
    {
      ul: [
        'Structured content with text and lists.',
        'Basic styling with custom font sizes and bold text.',
        'Uses the modern promise-based API for generation.'
      ]
    },
    { text: 'A small table:', style: 'subheader', margin: [0, 15, 0, 5] },
    {
      table: {
        headerRows: 1,
        widths: ['*', 'auto', 100],
        body: [
          ['Column 1', 'Column 2', 'Column 3'],
          ['One value', 'Another value', 'Some more text'],
          [{ text: 'Complex cell with span', colSpan: 2 }, {}, 'Last cell']
        ]
      }
    }
  ],
  styles: {
    header: { fontSize: 22, bold: true, alignment: 'center', margin: [0, 0, 0, 20] },
    subheader: { fontSize: 16, bold: true }
  },
  defaultStyle: {
    font: 'Roboto' // Ensure a font is available, Roboto is default via vfs_fonts
  }
};

async function generatePdf() {
  try {
    const pdfDoc = pdfMake.createPdf(docDefinition);
    const buffer = await pdfDoc.getBuffer();
    fs.writeFileSync('output.pdf', buffer);
    console.log('PDF generated successfully: output.pdf');
  } catch (error) {
    console.error('Error generating PDF:', error);
  }
}

generatePdf();