CVE-2026-25535

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.0

Description An issue exists where the addImage() and html() methods accept user input in their first argument without proper sanitization. An attacker can provide a specially crafted GIF file containing excessively large width and height values in the headers. This forces the application to allocate an excessive amount of memory, leading to an out-of-memory condition, application crashes, and denial of service.

Recommendations Update to version 4.2.0 or later. As a temporary workaround, sanitize image data or URLs before passing them to the addImage() method or the html() method.