jsPDF has Shared State Race Condition in addJS Plugin

Description

The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.1.0

References

• GHSA-cjw8-79x6-5cj4
• CVE-2026-24040
• CWE-200
• CWE-362
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6