{"id":"CVE-2026-24040","aliases":["GHSA-cjw8-79x6-5cj4"],"url":"https://o3.security/vulnerability/CVE-2026-24040","summary":"jsPDF has a Shared State Race Condition in addJS Plugin","details":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.","published":"2026-02-02T20:38:24.732Z","modified":"2026-08-27T03:30:27.893758843Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"jspdf","fixedVersion":"4.1.0"}],"fix":{"url":"https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e","label":"parallax/jsPDF@2863e5c"},"references":[{"type":"WEB","url":"https://github.com/parallax/jsPDF/releases/tag/v4.1.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24040.json"},{"type":"ADVISORY","url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24040"},{"type":"FIX","url":"https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:30:27.893758843Z"}}