jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service.
Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0.
As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Parall Jspdf
cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*
|
— |
4.2.0
|
References 9
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md
security-advisories@github.com
https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5…
security-advisories@github.com
https://github.com/parallax/jsPDF/releases/tag/v4.2.0
security-advisories@github.com
https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj
security-advisories@github.com
https://access.redhat.com/errata/RHSA-2026:7110
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:7128
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/security/cve/CVE-2026-25535
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://bugzilla.redhat.com/show_bug.cgi?id=2440992
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25535.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c