jsPDF has Shared State Race Condition in addJS Plugin

Description

The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.1.0

References

• GHSA-cjw8-79x6-5cj4
• CVE-2026-24040
• CWE-200
• CWE-362
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
• jsPDF has a PDF Object Injection via FreeText color - CVE-2026-31898
• jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution - CVE-2026-24737
• jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" pr - CVE-2026-25940

Tags:

npm

jspdf