VDB
Sign up
HIGH

GHSA-67pg-wm7f-q7fj

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Quick fix

GHSA-67pg-wm7f-q7fj — jspdf: upgrade to the fixed version with the command below.

npm install jspdf@4.2.0

Details

### Impact

User control of the first argument of the `addImage` method results in denial of service.

If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.

Other affected methods are: `html`.

Example attack vector:

```js import { jsPDF } from "jspdf"

// malicious GIF image data with large width/height headers const payload = ...

const doc = new jsPDF();

doc.addImage(payload, "GIF", 0, 0, 100, 100); ```

### Patches

The vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@>=4.2.0.

### Workarounds

Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods. ### References https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jspdf
Introduced in: 0Fixed in: 4.2.0
Fixnpm install jspdf@4.2.0

References