CVE-2026-25535: jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-19 · updated 2026-08-18
Weakness: CWE-400

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.

Affected products

parallax jsPDF: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: parallax jsPDF 4.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25535 or the next vulnerability affects your stack