CVE-2026-24133
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
- Record
CVE-2026-24133- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-5295
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
- Record
EUVD-2026-5295- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-95fx-jjr5-f39c
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Impact
User control of the first argument of the addImage method results in Denial of Service.
If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, wich lead to excessive memory allocation.
Other affected methods are: html.
Example attack vector:
import { jsPDF } from "jspdf"
// malicious BMP image data with large width/height headers
const payload = ...
const doc = new jsPDF();
doc.addImage(payload, "BMP", 0, 0, 100, 100);
Patches
The vulnerability has been fixed in jsPDF 4.1.0. Upgrade to jspdf@>=4.1.0.
Workarounds
Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
- Record
GHSA-95fx-jjr5-f39c- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
- Record
CVE-2026-24133- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
- Record
CVE-2026-24133- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-95fx-jjr5-f39c
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Impact
User control of the first argument of the addImage method results in Denial of Service.
If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, wich lead to excessive memory allocation.
Other affected methods are: html.
Example attack vector:
import { jsPDF } from "jspdf"
// malicious BMP image data with large width/height headers
const payload = ...
const doc = new jsPDF();
doc.addImage(payload, "BMP", 0, 0, 100, 100);
Patches
The vulnerability has been fixed in jsPDF 4.1.0. Upgrade to jspdf@>=4.1.0.
Workarounds
Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
- Record
GHSA-95fx-jjr5-f39c- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-400, CWE-770
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1773447392 No score
TuxCare security update for jspdf (4 CVEs)
TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 3.0.4-tuxcare.4.
- Record
CLSA-2026-1773447392- Updated
- 2026-11-02
OSVCLSA-2026-1773620212 No score
TuxCare security update for jspdf (4 CVEs)
TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 2.5.2-tuxcare.6.
- Record
CLSA-2026-1773620212- Updated
- 2026-11-02
OSVCLSA-2026-1780534264 No score
TuxCare security update for jspdf (12 CVEs)
TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1.
- Record
CLSA-2026-1780534264- Updated
- 2026-11-02
OSVCLSA-2026-1780966320 No score
TuxCare security update for jspdf (9 CVEs)
TuxCare rebuilt jspdf to address 9 CVEs. Fixed in 1.4.1-tuxcare.2.
- Record
CLSA-2026-1780966320- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-24133 No score
CVE-2026-24133 in jspdf - Patched by Root
Root has patched CVE-2026-24133 in the jspdf package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-24133- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jspdfnpm |
through 4.0.0 | 4.1.0 |
jspdfTuxCare:npm From an advisory covering 4 CVEs |
3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions 3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3 |
3.0.4-tuxcare.4 |
jspdfTuxCare:npm From an advisory covering 4 CVEs |
2.5.2-tuxcare.0 up to 2.5.2-tuxcare.6, plus listed versions 2.5.22.5.2-tuxcare.12.5.2-tuxcare.22.5.2-tuxcare.32.5.2-tuxcare.42.5.2-tuxcare.5 |
2.5.2-tuxcare.6 |
jspdfTuxCare:npm From an advisory covering 12 CVEs |
2.5.1-tuxcare.0 up to 2.5.1-tuxcare.1, plus listed versions 2.5.1 |
2.5.1-tuxcare.1 |
jspdfTuxCare:npm From an advisory covering 9 CVEs |
1.4.1-tuxcare.0 up to 1.4.1-tuxcare.2, plus listed versions 1.4.11.4.1-tuxcare.1 |
1.4.1-tuxcare.2 |
jspdfnpm |
before 4.1.0 | 4.1.0 |
jspdfRoot:npm |
before 2.5.2-aikido.1 | 2.5.2-aikido.14.0.0-aikido.1 |
@rootio/jspdfRoot:npm |
before 2.5.2-root.io.1 | 2.5.2-root.io.14.0.0-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24133 is a high vulnerability (CVSS 8.7) in Parall Jspdf, published February 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in jspdf 4.1.0.
References
github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c
nvd.nist.gov/vuln/detail/CVE-2026-24133