jsPDF
CVE-2026-25535
HIGH
GHSA-67pg-wm7f-q7fj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable image input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is purely availability via OOM crash, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
11Blast Radius
ecosystem impact- 2 npm packages depend on jspdf (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.0.
DescriptionCVE.org
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: html. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
AnalysisAI
Denial of service in jsPDF (npm package, all versions prior to 4.2.0) lets an attacker who can supply image input to the addImage or html methods crash the host process. A malicious GIF whose header declares enormous width/height values forces the bundled omggif decoder to attempt allocation of an oversized pixel buffer, producing out-of-memory errors. Publicly available exploit code exists (no active exploitation reported in CISA KEV), and the EPSS probability is low at 0.05%.
Technical ContextAI
jsPDF embeds raster images by parsing them with an internal copy of the omggif GIF decoder (src/libs/omggif.js). A GIF logical screen / image descriptor declares width and height fields in its header; the decoder multiplies these to size a pixel buffer before any bounds checking. The root cause maps to CWE-400 (Uncontrolled Resource Consumption): attacker-controlled dimension fields drive an unbounded memory allocation (num_pixels = width * height) with no upper limit. The fix commit (2e5e156) adds two guards that throw 'Image dimensions exceed 512MB' when num_pixels exceeds 512*1024*1024. The affected component is the Node.js distribution of the package per CPE cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*, though the GHSA notes the flaw is both client-side and server-side since jsPDF runs in browsers and Node.
RemediationAI
Vendor-released patch: jsPDF 4.2.0 - upgrade the jspdf dependency to >=4.2.0 (release https://github.com/parallax/jsPDF/releases/tag/v4.2.0, fix commit https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5e6, advisory https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj). Red Hat consumers should apply RHSA-2026:7110 and RHSA-2026:7128. If immediate upgrade is not possible, the vendor-recommended workaround is to sanitize image data and URLs before they reach addImage or html: validate that decoded GIF header width*height stays under a safe ceiling (the patch uses 512MB of pixels) and reject oversized images, and/or restrict addImage to a trusted allowlist of image sources rather than accepting arbitrary user-supplied data or remote URLs. The trade-off of source restriction is reduced functionality for features that legitimately need user-provided images; the trade-off of dimension validation is the need to parse headers yourself, which the upgrade does for you, so upgrading is strongly preferred.
PDF object injection in the jsPDF JavaScript library (npm package 'jspdf', versions prior to 4.2.0) lets an attacker who
PDF generation in jsPDF prior to version 4.1.0 allows injection of arbitrary PDF objects through unsanitized input passe
Denial of service in jsPDF prior to version 4.1.0 occurs when malicious BMP files with oversized dimension headers are p
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex. Ra
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS
Jspdf versions up to 4.1.0 contains a vulnerability that allows attackers to inject arbitrary XML (CVSS 5.4).
Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) p
jsPDF versions prior to 4.1.0 contain a race condition in the addJS method where a shared module-scoped variable is over
jsPDF versions prior to 4.2.0 allow attackers to inject arbitrary PDF objects including malicious JavaScript through uns
This affects the package jspdf before 2.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
jsPDF is a library to generate PDFs in JavaScript. Rated high severity (CVSS 8.7), this vulnerability is remotely exploi
jsPDF is a library to generate PDFs in JavaScript. Rated high severity (CVSS 8.7), this vulnerability is remotely exploi
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today