# What changed in pypdf

> 57 changes in pypdf 6 from its official release notes, upgrade guides and advisories: 52 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/pypdf/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pypdf 6

### Security

- Only /DCTDecode image data is opened with the Pillow JPEG plugin. (6.21.1) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.1)
- Improves performance and limits field work. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)
- Limits stream parsing work. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)
- Prevents cyclic tree handling. (6.20.1) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.20.1)
- pypdf: Possible large memory usage when retrieving alphabetical page labels (6.19.0) — [security advisory](https://github.com/advisories/GHSA-W23X-9JRW-R45C)
- pypdf: Possible long runtimes when generating appearance streams (6.19.0) — [security advisory](https://github.com/advisories/GHSA-PHP9-FJ8V-98FJ)
- pypdf: Possible long runtimes with large amount of embedded files (6.19.0) — [security advisory](https://github.com/advisories/GHSA-V247-6F48-MGCJ)
- pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) (6.18.1) — [security advisory](https://github.com/advisories/GHSA-FP3H-C4FM-7VVF)
- pypdf: Possible large memory usage when parsing font data (6.18.1) — [security advisory](https://github.com/advisories/GHSA-G9CG-PRRW-2R8Q)
- pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) (6.18.1) — [security advisory](https://github.com/advisories/GHSA-JW7Q-GVRG-4VJ3)
- pypdf: Possible long runtimes/large memory usage when parsing indirect objects (6.18.0) — [security advisory](https://github.com/advisories/GHSA-5JQ2-8X83-X246)
- pypdf: Possible large memory usage when retrieving Roman page labels (6.17.0) — [security advisory](https://github.com/advisories/GHSA-QV6H-RV94-W285)
- pypdf: Possible long runtimes/large memory usage when extracting XForm objects (6.16.1) — [security advisory](https://github.com/advisories/GHSA-763M-79HH-57F2)
- pypdf: Possible long runtimes/large memory usage when retrieving outlines (6.16.1) — [security advisory](https://github.com/advisories/GHSA-23W6-3W8W-8484)
- pypdf: Possible infinite loop for TreeObject.insert_child (6.16.0) — [security advisory](https://github.com/advisories/GHSA-JP53-MHQP-8XCG)
- pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace (6.15.0) — [security advisory](https://github.com/advisories/GHSA-FC8X-2RWW-XW9M)
- pypdf: Possible large memory usage for large /ToUnicode streams (6.15.0) — [security advisory](https://github.com/advisories/GHSA-FP3F-MC75-235C)
- pypdf: Possible long runtimes/large memory usage for large CID font width ranges (6.15.0) — [security advisory](https://github.com/advisories/GHSA-FWG2-594C-JP42)
- pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) (6.14.2) — [security advisory](https://github.com/advisories/GHSA-G867-7843-WF8Q)
- pypdf: Possible infinite loop for not terminated inline images (6.14.1) — [security advisory](https://github.com/advisories/GHSA-5XF7-4P34-54QR)
- pypdf: Possible large memory usage for wrong image dimensions (6.14.0) — [security advisory](https://github.com/advisories/GHSA-5QJQ-93H5-HRGP)
- pypdf: Possible long runtimes for repeated malformed cross-reference entries (6.14.0) — [security advisory](https://github.com/advisories/GHSA-55H5-XMCQ-C37V)
- pypdf: Missing stream length values ignore defined limits (6.13.3) — [security advisory](https://github.com/advisories/GHSA-JM82-FX9C-MX94)
- pypdf: Possible infinite loop when processing threads/articles in writer (6.13.1) — [security advisory](https://github.com/advisories/GHSA-G9XF-7F8Q-9MCJ)
- pypdf: Possible infinite loop when processing outlines/bookmarks in writer (6.13.0) — [security advisory](https://github.com/advisories/GHSA-M2V9-299J-RV96)
- pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction (6.13.0) — [security advisory](https://github.com/advisories/GHSA-52X6-GQ3R-VPF4)
- pypdf: Inefficient decoding of FlateDecode PNG predictor streams (6.12.2) — [security advisory](https://github.com/advisories/GHSA-5HGR-HG42-57JG)
- pypdf: Possible large memory usage for form XObjects during text extraction (6.12.2) — [security advisory](https://github.com/advisories/GHSA-J543-4VMF-QM7V)
- pypdf: Manipulated XMP metadata streams can exhaust RAM (6.12.1) — [security advisory](https://github.com/advisories/GHSA-WJQC-6W8F-H24C)
- pypdf: Possible large memory usage for large offsets for layout mode text (6.12.0) — [security advisory](https://github.com/advisories/GHSA-CJ93-CHG6-VGV8)
- pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams (6.12.0) — [security advisory](https://github.com/advisories/GHSA-248M-82V9-Q6G6)
- pypdf: Manipulated FlateDecode image dimensions can exhaust RAM (6.10.2) — [security advisory](https://github.com/advisories/GHSA-X284-J5P8-9C5P)
- pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM (6.10.2) — [security advisory](https://github.com/advisories/GHSA-7GW9-CF7V-778F)
- pypdf: Possible long runtimes for wrong size values in incremental mode (6.10.2) — [security advisory](https://github.com/advisories/GHSA-4PXV-J86V-MHCW)
- pypdf has long runtimes for wrong size values in cross-reference and object streams (6.10.1) — [security advisory](https://github.com/advisories/GHSA-JJ6C-8H6C-HPPX)
- pypdf: Manipulated XMP metadata entity declarations can exhaust RAM (6.10.0) — [security advisory](https://github.com/advisories/GHSA-3CRG-W4F6-42MX)
- pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream (6.9.2) — [security advisory](https://github.com/advisories/GHSA-87MJ-5GGW-8QC3)
- pypdf has inefficient decoding of array-based streams (6.9.1) — [security advisory](https://github.com/advisories/GHSA-QPXP-75PX-XJCP)
- pypdf: manipulated stream length values can exhaust RAM (6.8.0) — [security advisory](https://github.com/advisories/GHSA-HQMH-PPP3-XVM7)
- pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams (6.7.5) — [security advisory](https://github.com/advisories/GHSA-9M86-7PMV-2852)
- pypdf: Manipulated RunLengthDecode streams can exhaust RAM (6.7.4) — [security advisory](https://github.com/advisories/GHSA-F2V5-7JQ9-H8CG)
- pypdf: Manipulated FlateDecode XFA streams can exhaust RAM (6.7.3) — [security advisory](https://github.com/advisories/GHSA-X7HP-R3QG-R3CJ)
- pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams (6.7.2) — [security advisory](https://github.com/advisories/GHSA-2RW7-X74F-JG35)
- pypdf has a possible infinite loop when processing TreeObject (6.7.1) — [security advisory](https://github.com/advisories/GHSA-996Q-PR4M-CVGQ)
- pypdf has possible long runtimes/large memory usage for large /ToUnicode streams (6.7.1) — [security advisory](https://github.com/advisories/GHSA-WGVP-VG3V-2XQ3)
- pypdf possibly has long runtimes for malformed FlateDecode streams (6.7.1) — [security advisory](https://github.com/advisories/GHSA-9MVC-8737-8J8H)
- pypdf has possible Infinite Loop when processing outlines/bookmarks (6.6.2) — [security advisory](https://github.com/advisories/GHSA-2Q4J-M29V-HQ73)
- pypdf has possible long runtimes for malformed startxref (6.6.0) — [security advisory](https://github.com/advisories/GHSA-4F6G-68PF-7VHV)
- pypdf has possible long runtimes for missing /Root object with large /Size values (6.6.0) — [security advisory](https://github.com/advisories/GHSA-4XC4-762W-M6CG)
- pypdf's LZWDecode streams be manipulated to exhaust RAM (6.4.0) — [security advisory](https://github.com/advisories/GHSA-M449-CWJH-6PW7)
- pypdf can exhaust RAM via manipulated LZWDecode streams (6.1.3) — [security advisory](https://github.com/advisories/GHSA-JFX9-29X2-RV3J)
- pypdf possibly loops infinitely when reading DCT inline images without EOF marker (6.1.3) — [security advisory](https://github.com/advisories/GHSA-VR63-X8VC-M265)

### New APIs and options

- Allows custom fit modes for named destinations. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)

### Fixes and other changes

- Avoids overwriting unread objects in add_form_topname. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)
- Treats NUL as whitespace in ArrayObject. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)
- Reads an indirect page box on a writer page. (6.21.0) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.21.0)
- Only reads the color operator from a text field's default appearance. (6.20.1) — [release notes](https://github.com/py-pdf/pypdf/releases/tag/6.20.1)