Is CVE-2026-24133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24133 being exploited in the wild.

How severe is CVE-2026-24133?

Medium severity, with a CVSS score of 4, published 2 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.

Is there a fix for CVE-2026-24133?

Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24133?

Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24133: jsPDF denial of service via unvalidated BMP dimensions

CVE-2026-24133 · Severity: medium · CVSS 4 · Published 2026-02-02

jsPDF is a JavaScript library used to generate PDF documents in web browsers and Node.js applications. A vulnerability in the BMP image decoder allows attackers to cause out-of-memory errors and application crashes by providing specially crafted BMP files with extremely large width and height values in their headers. This can disrupt services that accept user-supplied images or URLs for PDF generation.

Technologies: jspdf (npm). Vendors: npm.

Quick answers

Is CVE-2026-24133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24133 being exploited in the wild.
How severe is CVE-2026-24133?: Medium severity, with a CVSS score of 4, published 2 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2026-24133?: Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24133?: Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.1.0 or later
```
npm install jspdf@4.1.0
```

Technical details

The vulnerability is an improper input validation flaw (CWE-20, CWE-400, CWE-770) in the BMPDecoder component of jsPDF. When processing BMP images via the addImage() method (and related methods like html()), the decoder does not validate the width and height values in the BMP file header before allocating memory. An attacker providing a malicious BMP file with large dimension values can trigger excessive memory allocation, exhausting system resources and causing denial of service. The attack requires only network access and no authentication; the attacker must control the image data or URL passed to vulnerable methods. The vulnerability affects all versions prior to 4.1.0, which includes the fix. Workarounds include sanitizing image data before processing.

Affected products

Parallax jsPDF < 4.1.0

Identifiers

CVE-2026-24133
GHSA-95fx-jjr5-f39c

Timeline

2026-02-02: disclosed
2026-02-02: patched: Version 4.1.0 released with fix

References

https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.