Cross-User Data Leakage in jsPDF Library by Parallax
CVE-2026-24040

6.3MEDIUM

Key Information:

Vendor

Parallax

Status
JsPDF
Vendor
CVE Published:
2 February 2026

What is CVE-2026-24040?

The jsPDF library, used for PDF generation in JavaScript, has a vulnerability that arises from utilizing a shared module-scoped variable (text) for storing JavaScript content in its Node.js build. This issue is particularly critical in concurrent server-side environments, where simultaneous requests can lead to one user's content being inadvertently shared with another. As a result, a PDF generated for User A may unintentionally include JavaScript payloads or sensitive data meant for User B. This could lead to significant security risks if unaddressed. The issue has been resolved in version 4.1.0 of the jsPDF library.

Affected Version(s)

jsPDF < 4.1.0

References

https://github.com/parallax/jsPDF/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/parallax/jsPDF/commit/2863e5c26afef211...
x_refsource_MISC
https://github.com/parallax/jsPDF/releases/tag/v4.1.0
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.