{"id":"CVE-2026-25535","aliases":["CLSA-2026-1773620207","CLSA-2026-1773620213","CLSA-2026-1780534264","CLSA-2026-1780966320","EUVD-2026-8095","GHSA-67pg-wm7f-q7fj","ROOT-APP-NPM-CVE-2026-25535"],"status":"published","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0084,"percentile":0.58148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-02-19T14:34:05Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"npm","package":"jspdf","fixed_in":["4.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"jspdf","fixed_in":["2.5.2-aikido.1","4.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jspdf","fixed_in":["2.5.2-root.io.1","4.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.6"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3","3.0.4-tuxcare.4","3.0.4-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.2-tuxcare.0"},{"fixed":"2.5.2-tuxcare.7"}]}],"versions":["2.5.2","2.5.2-tuxcare.1","2.5.2-tuxcare.2","2.5.2-tuxcare.3","2.5.2-tuxcare.4","2.5.2-tuxcare.5","2.5.2-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.1-tuxcare.0"},{"fixed":"2.5.1-tuxcare.1"}]}],"versions":["2.5.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.2"}]}],"versions":["1.4.1","1.4.1-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"jspdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-aikido.1"},{"fixed":"4.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jspdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-root.io.1"},{"fixed":"4.0.0-root.io.1"}]}]}],"products":[{"vendor":"parall","product":"jspdf"},{"vendor":"parallax","product":"jspdf"},{"vendor":"red hat","product":"red hat advanced cluster security 4.8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"}],"references":[{"url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5e6","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","tags":["x_refsource_MISC","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25535","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440992","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25535.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25535","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-67pg-wm7f-q7fj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25535.json","tags":["advisory"]},{"url":"https://github.com/parallax/jsPDF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25535","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","status":"published","published":"2026-02-19T14:34:05.648Z","modified":"2026-09-07T12:04:56.383Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-770","CWE-770"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-8095","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","status":"published","published":"2026-02-19T14:34:05Z","modified":"2026-09-07T12:04:56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-67pg-wm7f-q7fj","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"### Impact\n\nUser control of the first argument of the `addImage` method results in denial of service.\n\nIf given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.\n\nOther affected methods are: `html`.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\n// malicious GIF image data with large width/height headers\nconst payload = ...\n\nconst doc = new jsPDF();\n\ndoc.addImage(payload, \"GIF\", 0, 0, 100, 100);\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@\u003e=4.2.0.\n\n### Workarounds\n\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","status":"published","published":"2026-02-19T15:25:48Z","modified":"2026-02-19T20:58:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-25535","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","status":"published","published":"2026-02-19T15:16:12.13Z","modified":"2026-08-18T12:17:45.263Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-25535","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.","status":"published","published":"2026-02-19T14:34:05.648Z","modified":"2026-10-28T02:30:22.869476095Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-67pg-wm7f-q7fj","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","description":"### Impact\n\nUser control of the first argument of the `addImage` method results in denial of service.\n\nIf given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.\n\nOther affected methods are: `html`.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\n// malicious GIF image data with large width/height headers\nconst payload = ...\n\nconst doc = new jsPDF();\n\ndoc.addImage(payload, \"GIF\", 0, 0, 100, 100);\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@\u003e=4.2.0.\n\n### Workarounds\n\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","status":"published","published":"2026-02-19T15:25:48Z","modified":"2026-09-10T03:49:48.422831128Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"CLSA-2026-1773620207","title":"TuxCare security update for jspdf (3 CVEs)","description":"TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 3.0.4-tuxcare.6.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:46.836381443Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773620213","title":"TuxCare security update for jspdf (3 CVEs)","description":"TuxCare rebuilt jspdf to address 3 CVEs. Fixed in 2.5.2-tuxcare.7.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:47.178165437Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1780534264","title":"TuxCare security update for jspdf (12 CVEs)","description":"TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.75648635Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780966320","title":"TuxCare security update for jspdf (9 CVEs)","description":"TuxCare rebuilt jspdf to address 9 CVEs. Fixed in 1.4.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.242378425Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"ROOT-APP-NPM-CVE-2026-25535","title":"CVE-2026-25535 in jspdf - Patched by Root","description":"Root has patched CVE-2026-25535 in the jspdf package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T04:07:07Z","modified":"2026-10-08T05:15:03.869906233Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}