jspdf vulnerable to Regular Expression Denial of Service (ReDoS)

Description

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-57f3-gghm-9mhc
• snyk.io
• CVE-2021-23353
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) (GHSA-545q-3fg6-48m7) - CVE-2021-23346
• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
• Regular Expression Denial of Service (ReDoS) in Prism - CVE-2021-32723
• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844

Tags:

npm

jspdf