PT-2025-34787 · Parallax · Jspdf

Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-57810

Mitre

CVSS v4.0

8.7

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.

Exploit

Fix

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-20

CWE-770

Related Identifiers

CVE-2025-57810

Affected Products

Jspdf

References · 7

• 🔥 https://github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57810 · Security Note
• https://github.com/parallax/jsPDF/pull/3880 · Note
• https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9 · Note
• https://github.com/parallax/jsPDF/releases/tag/v3.0.2 · Note
• https://twitter.com/CveFindCom/status/1960374472948449550 · Twitter Post
• https://twitter.com/CVEnew/status/1960369278927966477 · Twitter Post