Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
INFO
Published Date :
2026-02-19T14:34:05.648Z
Last Modified :
2026-02-19T16:03:26.484Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25535 vulnerability.
| Vendors | Products |
|---|---|
| Parall |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25535.
