# CVE-2021-23353: jsPDF ReDoS in addImage function

Source: https://junglewise.ai/threats/cve-2021-23353-jspdf-redos-in-addimage-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23353 · Severity: low · CVSS 3.1 · Published 2021-03-12

jsPDF is a popular JavaScript library used to generate PDF documents in web applications. The library contains a regular expression parsing flaw in its addImage function that can be exploited to cause a denial of service by sending specially crafted input. An attacker can force the application to spend excessive CPU time processing the malicious input, leading to service unavailability or slow performance for legitimate users.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23353 being exploited in the wild.

**How severe is CVE-2021-23353?** Low severity, with a CVSS score of 3.1, published 12 March 2021.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=2.3.1.

**Is there a fix for CVE-2021-23353?** Yes. jspdf (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23353 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23353?** Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 2.3.1 or later

  ```sh
  npm install jspdf@2.3.1
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the addImage function within jsPDF versions prior to 2.3.1. The vulnerable regex pattern uses nested quantifiers that exhibit catastrophic backtracking behavior when processing certain input strings. Specifically, the pattern `/^data:(\w*\/\w*);*charset=[\\w=-]*;*$/` fails to efficiently handle strings with repetitive characters followed by a non-matching character, causing the regex engine to explore an exponentially increasing number of backtracking paths. An attacker can provide a specially crafted data URL to the addImage function that triggers this condition, causing the JavaScript engine to consume CPU resources until completion. The attack requires no authentication or user interaction and is exploitable over the network if the vulnerable code processes untrusted input. The vulnerability was patched in version 2.3.1 with a corrected regex pattern.

## Affected products

- jsPDF jsPDF before 2.3.1

## Identifiers

- CVE-2021-23353
- GHSA-57f3-gghm-9mhc

## Timeline

- 2021-02-12: disclosed
- 2021-03-09: advisory: NVD published the CVE
- 2021-03-12: patched: Fixed in jsPDF 2.3.1

## References

- [https://github.com/MrRio/jsPDF/pull/3091](https://github.com/MrRio/jsPDF/pull/3091)
- [https://github.com/MrRio/jsPDF/commit/d8bb3b39efcd129994f7a3b01b632164144ec43e](https://github.com/MrRio/jsPDF/commit/d8bb3b39efcd129994f7a3b01b632164144ec43e)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1083289](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1083289)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1083287](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1083287)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1083286](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1083286)

## Related threats

- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)
- [parallax jsPDF PDF injection in Acroform module](https://junglewise.ai/threats/cve-2026-25940-parallax-jspdf-pdf-injection-in-acroform-module)
- [parallax jsPDF PDF object injection in addJS method](https://junglewise.ai/threats/cve-2026-25755-parallax-jspdf-pdf-object-injection-in-addjs-method)
- [parallax jsPDF denial of service in addImage method](https://junglewise.ai/threats/cve-2026-25535-parallax-jspdf-denial-of-service-in-addimage-method)