{"id":"GHSA-67pg-wm7f-q7fj","summary":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","details":"### Impact\n\nUser control of the first argument of the `addImage` method results in denial of service.\n\nIf given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.\n\nOther affected methods are: `html`.\n\nExample attack vector:\n\n```js\nimport { jsPDF } from \"jspdf\" \n\n// malicious GIF image data with large width/height headers\nconst payload = ...\n\nconst doc = new jsPDF();\n\ndoc.addImage(payload, \"GIF\", 0, 0, 100, 100);\n```\n\n### Patches\n\nThe vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@\u003e=4.2.0.\n\n### Workarounds\n\nSanitize image data or URLs before passing it to the addImage method or one of the other affected methods.\n### References\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md","aliases":["CVE-2026-25535"],"modified":"2026-07-17T21:10:47.800259693Z","published":"2026-02-19T15:25:48Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-02-19T15:25:48Z","nvd_published_at":"2026-02-19T15:16:12Z","cwe_ids":["CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/parallax/jsPDF/security/advisories/GHSA-67pg-wm7f-q7fj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25535"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/commit/2e5e156e284d92c7d134bce97e6418756941d5e6"},{"type":"WEB","url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md"},{"type":"PACKAGE","url":"https://github.com/parallax/jsPDF"},{"type":"WEB","url":"https://github.com/parallax/jsPDF/releases/tag/v4.2.0"}],"affected":[{"package":{"name":"jspdf","ecosystem":"npm","purl":"pkg:npm/jspdf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-67pg-wm7f-q7fj/GHSA-67pg-wm7f-q7fj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}