Which versions of Node.js are affected by CVE-2025-68428?

jsPDF Node.js library versions prior to 4.0.0 contain a critical path traversal vulnerability allowing server-side file disclosure when user input reaches PDF generation methods.. A patch is available.

How to fix or mitigate CVE-2025-68428?

Within 24 hours: Audit all code repositories and dependencies for jsPDF usage prior to version 4.0.0; identify applications with user-influenced PDF generation. Within 7 days: Upgrade jsPDF to version 4.0.0 across all environments (development, staging, production); redeploy affected services. Within 30 days: Review PDF generation logs for exploitation attempts; rotate any exposed credentials identified; implement input validation standards for all file path parameters passed to jsPDF methods (loadFile, addImage, html, addFont).

Node.js CVE-2025-68428

Q: What is the CVSS score of CVE-2025-68428?

CVE-2025-68428 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Path Traversal: '.../...//' (CWE-35)

2026-01-05 security-advisories@github.com

GHSA-f8cm-6447-x5h2

Path Traversal Node.js Jspdf Parall

9.2

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable via the embedding app with no auth or interaction (AV:N/PR:N/UI:N); arbitrary file read crosses jsPDF's scope to the host (S:C, C:H), with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

8.6 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:13 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:11 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:11 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:23 NVD

HIGH CRITICAL

CVSS changed

Jun 30, 2026 - 03:23 NVD

7.5 (HIGH) 9.2 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 16, 2026 - 18:34 nvd

Patch available

CVE Published

Jan 05, 2026 - 22:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on jspdf (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are addImage, html, and addFont. Only the node.js builds of the library are affected, namely the dist/jspdf.node.js and dist/jspdf.node.min.js files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the --permission flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF.

AnalysisAI

Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0 lets an attacker who controls the path argument passed to loadFile, addImage, html, or addFont read arbitrary files from the host filesystem, with the file contents embedded verbatim into the generated PDF. Applications that forward unsanitized user input into these methods leak secrets such as /etc/passwd, configuration files, or private keys to anyone who can request a PDF. No public exploit identified at time of analysis; EPSS risk is very low (0.02%, 6th percentile) and the issue is not in CISA KEV.