jsPDF Bypass Regular Expression Denial of Service (ReDoS)

Description

User control of the first argument of the addImage method results in CPU utilization and denial of service.

If given the possibility to pass unsanitized image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service.

Other affected methods are: html, addSvgAsImage.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.1
• Patched version(s): 3.0.1

References

• GHSA-w532-jxjh-hjhj
• CVE-2025-29907
• CWE-400
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• jspdf vulnerable to Regular Expression Denial of Service (ReDoS) - CVE-2021-23353
• Regular Expression Denial of Service (ReDoS) in lodash - lodash - CVE-2019-1010266
• Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths - CVE-2026-39320
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - GHSA-x5rq-j2xg-h7qm - CVE-2019-1010266

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

jspdf