jspdf vulnerable to Regular Expression Denial of Service (ReDoS)

Description

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-57f3-gghm-9mhc
• snyk.io
• CVE-2021-23353
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Server secret was included in static assets and served to clients - Vulnerability
• jsPDF Bypass Regular Expression Denial of Service (ReDoS) - CVE-2025-29907
• Trix allows Cross-site Scripting via `javascript:` url in a link - CVE-2025-21610
• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262

Tags:

npm

jspdf