Executive brief
jsPDF is a popular JavaScript library used to generate PDF documents in web applications. A regular expression denial-of-service (ReDoS) vulnerability in image URL parsing allows attackers to cause excessive CPU consumption and application hangs by providing malformed data URLs to the addImage, html, or addSvgAsImage methods. This can disrupt service availability for all users of an application relying on these functions.
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) affecting jsPDF versions up to 3.0.0. It exists in the image URL parsing logic used by the addImage, html, and addSvgAsImage methods. When these methods receive user-controlled input containing a crafted data URL with a repetitive charset pattern (e.g., 'data:/charset=s' repeated multiple times), the vulnerable regex enters catastrophic backtracking, causing extreme CPU utilization and application hang. No authentication or user interaction is required; an attacker only needs network access to send a malicious image URL to an application using vulnerable jsPDF. The fix was released in jsPDF 3.0.1.
Affected products
- parallax jsPDF <=3.0.0
Timeline
- 2025-03-18: disclosed: Vulnerability published
- 2025-03-18: patched: Fix released in jsPDF 3.0.1