Description
User control of the first argument of the addImage method results in CPU utilization and denial of service.
If given the possibility to pass unsanitized image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service.
Other affected methods are: html, addSvgAsImage.
Recommendation
Update the jspdf package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.1
- Patched version(s): 3.0.1
References
Could your website be exposed too?
SmartScanner can check your website for jsPDF Bypass Regular Expression Denial of Service (ReDoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jspdf vulnerable to Regular Expression Denial of Service (ReDoS) - CVE-2021-23353
- Regular Expression Denial of Service (ReDoS) in lodash - lodash-amd - CVE-2019-1010266
- (ReDoS) Regular Expression Denial of Service in tf2-item-format - CVE-2024-41655
- Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
You might also like:
See something that needs correcting? Let us knowUpdated March 19, 2025