Denial of Service Vulnerability in jsPDF JavaScript Library
CVE-2025-29907

8.7HIGH

Key Information:

Vendor

Parallax

Status
JsPDF
Vendor
CVE Published:
18 March 2025

What is CVE-2025-29907?

The jsPDF JavaScript library prior to version 3.0.1 is susceptible to a denial of service vulnerability. This occurs when a user can control the first argument of the addImage method, allowing for the submission of unsanitized image URLs. Such malicious data URLs can cause significant CPU utilization, potentially leading to system instability and denial of service. Additionally, similar issues may affect the html and addSvgAsImage methods. Users are advised to upgrade to jsPDF version 3.0.1 or later to mitigate these risks.

Affected Version(s)

jsPDF < 3.0.1

References

https://github.com/parallax/jsPDF/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/parallax/jsPDF/commit/b167c43c27c466eb...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.