PT-2026-20849 · Jspdf · Jspdf
Zeroxjacks
·
Published
2026-02-19
·
Updated
2026-02-19
·
CVE-2026-25535
CVSS v4.0
8.7
High
| AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
jsPDF versions prior to 4.2.0
Description
jsPDF is a JavaScript library used to generate PDFs. A flaw exists where user-controlled input to the
addImage method can lead to denial of service. Specifically, providing a malicious GIF file with large width and/or height values in its header can cause excessive memory allocation, resulting in out-of-memory errors. The html method is also affected. An example attack vector involves using the addImage function with a crafted payload containing harmful GIF image data. The addImage function takes a payload as its first argument.Recommendations
jsPDF versions prior to 4.2.0 should be upgraded to version 4.2.0 or later.
As a workaround, sanitize image data or URLs before passing them to the
addImage method or the html method.Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jspdf