I crossed check again and also informed Mozilla about this. "The development server used in PDF.js gets crash when a malformed URI(bad request) is sent." Thank you all, for your suggestions and cross checking this.

Yeah I’m not sure that’s a format string bug buddy.

This issue was observed in PDF.js URI when we run gulp server which depends on multiple npm modules. However when this was patch by Mozilla it was mention as format string vulnerability over there 😅

Is it though? Was there any illegal memory access through an incorrect pointer dereference?

As far I debug it, I haven't found any incorrect or null ptr in this case.

Did you really understand what format string vuln is? It is just an unhandled malformed URI exception