Executive brief
jsPDF is a JavaScript library used to generate PDF documents in web browsers and Node.js applications. A vulnerability in the BMP image decoder allows attackers to cause out-of-memory errors and application crashes by providing specially crafted BMP files with extremely large width and height values in their headers. This can disrupt services that accept user-supplied images or URLs for PDF generation.
Technical details
The vulnerability is an improper input validation flaw (CWE-20, CWE-400, CWE-770) in the BMPDecoder component of jsPDF. When processing BMP images via the addImage() method (and related methods like html()), the decoder does not validate the width and height values in the BMP file header before allocating memory. An attacker providing a malicious BMP file with large dimension values can trigger excessive memory allocation, exhausting system resources and causing denial of service. The attack requires only network access and no authentication; the attacker must control the image data or URL passed to vulnerable methods. The vulnerability affects all versions prior to 4.1.0, which includes the fix. Workarounds include sanitizing image data before processing.
Affected products
- Parallax jsPDF < 4.1.0
Timeline
- 2026-02-02: disclosed
- 2026-02-02: patched: Version 4.1.0 released with fix