Description (CNA)
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| parallax / jsPDF | affected < 4.2.0 |
CWE
CWE-400, CWE-770
References
- https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj
- https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5e6
- https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md
- https://github.com/parallax/jsPDF/releases/tag/v4.2.0
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in jsPDF. The addImage and html methods accept user input in their first argument without proper sanitization. An attacker can supply a specially crafted GIF file, specifically with invalid width and height header values, forcing the application to allocate an excessive amount of memory, leading to an out-of-memory condition, causing an application crash and denial of service.