Executive brief
jsPDF is a widely-used JavaScript library for generating PDF documents. The addJS method, which embeds JavaScript code into PDFs, uses a shared module-level variable that is not properly isolated between concurrent requests in server environments. When multiple PDF generation requests run simultaneously, JavaScript content and any sensitive data embedded in one user's PDF can be leaked into another user's PDF, exposing confidential information across users.
Technical details
The vulnerability is a classic shared state race condition (CWE-362) in the addJS method of jsPDF's Node.js build. The root cause is the use of a module-scoped variable named "text" to store JavaScript content without proper instance-level isolation. In concurrent environments (such as Node.js web servers), when multiple requests invoke addJS() simultaneously, a second request can overwrite the shared variable before the first request's PDF is saved, resulting in cross-user data leakage. The attack requires only network access and does not require authentication or user interaction; it naturally occurs in any multi-request server scenario. Attackers can harvest sensitive data, credentials, or other payloads intended for other users. The vulnerability was fixed in jspdf@4.0.1 by moving the variable into function scope to ensure instance isolation.
Affected products
- jsPDF Contributors jsPDF before 4.0.1
Timeline
- 2026-02-02: disclosed
- 2026-02-02: patched: Fixed in jspdf@4.0.1
- 2026-02-02: advisory: CVE-2026-24040 and GHSA-cjw8-79x6-5cj4 published