NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-25535 — jspdf

Fix: parallax/jsPDF@2e5e156

CVE-2026-25535 is a Uncontrolled Resource Consumption vulnerability in jspdf. A fix is available for jspdf — see the affected versions and patch details below.

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Also known asGHSA-67pg-wm7f-q7fj
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25535.

EPSS Exploitation Probability

via FIRST.org ↗
0.8%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs58th percentile — riskier than 58% of all scored CVEsHighest risk
0.00%0.47%0.95%1.42%0.1%0.8%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

3Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
jspdfnpm
20.5Mdownloads / week

Description

Impact

User control of the first argument of the addImage method results in denial of service.

If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.

Other affected methods are: html.

Example attack vector:

import { jsPDF } from "jspdf" 

// malicious GIF image data with large width/height headers
const payload = ...

const doc = new jsPDF();

doc.addImage(payload, "GIF", 0, 0, 100, 100);

Patches

The vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@>=4.2.0.

Workarounds

Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.

References

https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmjspdfall versions4.2.0npm install jspdf@4.2.0

Affected Products

1 product · 1 configurations
Application
jspdfparall
< 4.2.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jspdf, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update jspdf to 4.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25535 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

To exploit this flaw, an attacker must be able to process a specially crafted GIF file with an application using the addImage or html methods. This issue can cause the application to allocate an excessive amount of memory, eventually resulting in a denial of service with no other security impact. Due to this reason,…

Workaround published by Red Hat
To mitigate this vulnerability, sanitize image data or validate resources fetched from URLs before calling the addImage or html methods, making sure that the width and height header values do not exceed safe and predefined limits.
Source: Red Hat security advisory for CVE-2026-25535 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Advanced Cluster Security 4.8advanced-cluster-security/rhacs-main-rhel8:1775594119RHSA-2026:7110
Red Hat Advanced Cluster Security 4.9advanced-cluster-security/rhacs-main-rhel8:1775594284RHSA-2026:7128

Frequently Asked Questions

### Impact User control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation. Other affected methods are: `html`. Example attack vector: ```js import { jsPDF } from "jspdf" // malicious GIF image data with large width/height headers const payload = ... const doc =
O3 Security · Impact-Aware SCA

Is CVE-2026-25535 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-25535: jspdf DoS — Fixed in 4.2.0