Executive brief
jsPDF is a widely-used JavaScript library for generating PDF documents. The library contains a vulnerability in its image handling code that allows attackers to submit specially crafted PNG files, causing the application to consume excessive CPU resources and become unresponsive. This can disrupt services that rely on jsPDF to generate reports, invoices, or other document exports.
Technical details
The vulnerability is a denial-of-service flaw in the addImage() method and related HTML rendering functions, triggered by improper validation of PNG image data (CWE-20, CWE-835). When an attacker provides a malformed PNG file or URL to addImage(), the library enters an infinite or very long-running loop while attempting to parse the image, causing CPU exhaustion. The attack requires only network access with no authentication or user interaction; any application using jsPDF that accepts unsanitized image input is vulnerable. The flaw was patched in jsPDF 3.0.2, which now throws an error for invalid PNG files instead of hanging.
Affected products
- parallax jsPDF <= 3.0.1
Timeline
- 2025-08-26: disclosed
- 2025-08-26: patched: jsPDF 3.0.2 released