# CVE-2026-24133: jsPDF denial of service via unvalidated BMP dimensions

Source: https://junglewise.ai/threats/cve-2026-24133-jspdf-denial-of-service-via-unvalidated-bmp-dimensions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-24133 · Severity: medium · CVSS 4 · Published 2026-02-02

jsPDF is a JavaScript library used to generate PDF documents in web browsers and Node.js applications. A vulnerability in the BMP image decoder allows attackers to cause out-of-memory errors and application crashes by providing specially crafted BMP files with extremely large width and height values in their headers. This can disrupt services that accept user-supplied images or URLs for PDF generation.

Technologies: [jspdf (npm)](https://junglewise.ai/threats/technologies/jspdf). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-24133 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24133 being exploited in the wild.

**How severe is CVE-2026-24133?** Medium severity, with a CVSS score of 4, published 2 February 2026.

**Which products and versions are affected?** jspdf (npm) SEMVER:introduced=0,fixed=4.1.0.

**Is there a fix for CVE-2026-24133?** Yes. jspdf (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24133 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24133?** Check whether you run jspdf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jspdf (npm): upgrade to 4.1.0 or later

  ```sh
  npm install jspdf@4.1.0
  ```


## Technical details

The vulnerability is an improper input validation flaw (CWE-20, CWE-400, CWE-770) in the BMPDecoder component of jsPDF. When processing BMP images via the addImage() method (and related methods like html()), the decoder does not validate the width and height values in the BMP file header before allocating memory. An attacker providing a malicious BMP file with large dimension values can trigger excessive memory allocation, exhausting system resources and causing denial of service. The attack requires only network access and no authentication; the attacker must control the image data or URL passed to vulnerable methods. The vulnerability affects all versions prior to 4.1.0, which includes the fix. Workarounds include sanitizing image data before processing.

## Affected products

- Parallax jsPDF < 4.1.0

## Identifiers

- CVE-2026-24133
- GHSA-95fx-jjr5-f39c

## Timeline

- 2026-02-02: disclosed
- 2026-02-02: patched: Version 4.1.0 released with fix

## References

- [https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c](https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c)

## Related threats

- [parallax jsPDF XSS in output function options](https://junglewise.ai/threats/cve-2026-31938-parallax-jspdf-xss-in-output-function-options)
- [parallax jsPDF PDF object injection in createAnnotation](https://junglewise.ai/threats/cve-2026-31898-parallax-jspdf-pdf-object-injection-in-createannotation)
- [parallax jsPDF PDF injection in Acroform module](https://junglewise.ai/threats/cve-2026-25940-parallax-jspdf-pdf-injection-in-acroform-module)
- [parallax jsPDF PDF object injection in addJS method](https://junglewise.ai/threats/cve-2026-25755-parallax-jspdf-pdf-object-injection-in-addjs-method)
- [parallax jsPDF denial of service in addImage method](https://junglewise.ai/threats/cve-2026-25535-parallax-jspdf-denial-of-service-in-addimage-method)