Quick answers
- Is CVE-2025-29907 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-29907 being exploited in the wild.
- How severe is CVE-2025-29907?
- Medium severity, with a CVSS score of 4, published 18 March 2025.
- Which products and versions are affected?
- jspdf (npm) SEMVER:introduced=0,fixed=3.0.1.
- Is there a fix for CVE-2025-29907?
- Yes. jspdf (npm): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-29907 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-29907?
- Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- jspdf (npm): upgrade to 3.0.1 or later
npm install jspdf@3.0.1
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) affecting jsPDF versions up to 3.0.0. It exists in the image URL parsing logic used by the addImage, html, and addSvgAsImage methods. When these methods receive user-controlled input containing a crafted data URL with a repetitive charset pattern (e.g., 'data:/charset=s' repeated multiple times), the vulnerable regex enters catastrophic backtracking, causing extreme CPU utilization and application hang. No authentication or user interaction is required; an attacker only needs network access to send a malicious image URL to an application using vulnerable jsPDF. The fix was released in jsPDF 3.0.1.
Affected products
- parallax jsPDF <=3.0.0
Identifiers
- CVE-2025-29907
- GHSA-w532-jxjh-hjhj
Timeline
- 2025-03-18: disclosed: Vulnerability published
- 2025-03-18: patched: Fix released in jsPDF 3.0.1