Denial of Service in jsPDF Library Prior to Version 4.2.0

CVE-2026-25535

What is CVE-2026-25535?

The jsPDF library, widely used for generating PDFs in JavaScript, is susceptible to denial of service due to inadequate input handling in the addImage method. An attacker can exploit this vulnerability by supplying unsanitized image data or URLs, which may lead to memory exhaustion and application crashes. This occurs when harmful GIF files with excessively large dimensions are processed, resulting in significant memory allocation issues. To mitigate this risk, users should sanitize all image inputs prior to invoking the addImage or other affected methods. The vulnerability has been resolved in jsPDF version 4.2.0.

References