Description
User control of the first argument of the addImage method results in CPU utilization and denial of service.
If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service.
Other affected methods are: html.
Recommendation
Update the jspdf package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.1
- Patched version(s): 3.0.2
References
Could your website be exposed too?
SmartScanner can check your website for jsPDF Denial of Service (DoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsPDF Bypass Regular Expression Denial of Service (ReDoS) - CVE-2025-29907
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
- jspdf vulnerable to Regular Expression Denial of Service (ReDoS) - CVE-2021-23353
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
You might also like:
See something that needs correcting? Let us knowUpdated September 10, 2025