Description
User control of the first argument of the addImage method results in denial of service.
If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in out of memory errors and denial of service.
Recommendation
Update the jspdf package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.2.0
- Patched version(s): 4.2.0
References
Could your website be exposed too?
SmartScanner can check your website for jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
- Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
- seroval affected by Denial of Service via RegExp serialization - CVE-2026-23956
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026