Is CVE-2026-24040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24040 being exploited in the wild.

How severe is CVE-2026-24040?

Medium severity, with a CVSS score of 4, published 2 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.

Is there a fix for CVE-2026-24040?

Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24040 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24040?

Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24040: jsPDF shared state race condition in addJS plugin

CVE-2026-24040 · Severity: medium · CVSS 4 · Published 2026-02-02

jsPDF is a widely-used JavaScript library for generating PDF documents. The addJS method, which embeds JavaScript code into PDFs, uses a shared module-level variable that is not properly isolated between concurrent requests in server environments. When multiple PDF generation requests run simultaneously, JavaScript content and any sensitive data embedded in one user's PDF can be leaked into another user's PDF, exposing confidential information across users.

Technologies: jspdf (npm). Vendors: npm.

Quick answers

Is CVE-2026-24040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24040 being exploited in the wild.
How severe is CVE-2026-24040?: Medium severity, with a CVSS score of 4, published 2 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2026-24040?: Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24040 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24040?: Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.1.0 or later
```
npm install jspdf@4.1.0
```

Technical details

The vulnerability is a classic shared state race condition (CWE-362) in the addJS method of jsPDF's Node.js build. The root cause is the use of a module-scoped variable named "text" to store JavaScript content without proper instance-level isolation. In concurrent environments (such as Node.js web servers), when multiple requests invoke addJS() simultaneously, a second request can overwrite the shared variable before the first request's PDF is saved, resulting in cross-user data leakage. The attack requires only network access and does not require authentication or user interaction; it naturally occurs in any multi-request server scenario. Attackers can harvest sensitive data, credentials, or other payloads intended for other users. The vulnerability was fixed in jspdf@4.0.1 by moving the variable into function scope to ensure instance isolation.

Affected products

jsPDF Contributors jsPDF before 4.0.1

Identifiers

CVE-2026-24040
GHSA-cjw8-79x6-5cj4

Timeline

2026-02-02: disclosed
2026-02-02: patched: Fixed in jspdf@4.0.1
2026-02-02: advisory: CVE-2026-24040 and GHSA-cjw8-79x6-5cj4 published

References

https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.