Is CVE-2026-25535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25535 being exploited in the wild.

How severe is CVE-2026-25535?

High severity, with a CVSS score of 7.5, published 19 February 2026.

Which products and versions are affected?

jspdf (npm) SEMVER:introduced=0,fixed=4.2.0.

Is there a fix for CVE-2026-25535?

Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25535 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25535?

Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25535: parallax jsPDF denial of service in addImage method

CVE-2026-25535 · Severity: high · CVSS 7.5 · Published 2026-02-19

jsPDF is a popular JavaScript library used to generate PDF documents in web browsers and server-side environments like Node.js. A vulnerability in how it handles images allows an attacker to provide a specially crafted GIF file that causes the application to crash or freeze by consuming all available memory. This can lead to service outages for web applications that allow users to upload or display images within generated PDFs.

Technologies: jspdf (npm), Red Hat Advanced Cluster Security for Kubernetes. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-25535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25535 being exploited in the wild.
How severe is CVE-2026-25535?: High severity, with a CVSS score of 7.5, published 19 February 2026.
Which products and versions are affected?: jspdf (npm) SEMVER:introduced=0,fixed=4.2.0.
Is there a fix for CVE-2026-25535?: Yes. jspdf (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25535 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25535?: Check whether you run jspdf (npm) or Red Hat Advanced Cluster Security for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jspdf (npm): upgrade to 4.2.0 or later
```
npm install jspdf@4.2.0
```

Technical details

A Denial of Service (DoS) vulnerability exists in jsPDF's GIF processing logic within the `gif_support.js` and `omggif.js` modules. The library fails to validate image dimensions (width and height) specified in the GIF Logical Screen Descriptor header before allocating memory for the pixel buffer. An attacker can supply a malicious GIF with extreme dimensions (e.g., 65535x65535), leading to an 'out of memory' (OOM) error or a process crash. This affects the `addImage` and `html` methods. The issue is fixed in version 4.2.0 by implementing a check to ensure image dimensions do not exceed a 512MB threshold.

Affected products

parallax jsPDF < 4.2.0
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.9

Identifiers

CVE-2026-25535
GHSA-67pg-wm7f-q7fj

Timeline

2026-02-19: disclosed
2026-02-19: patched: Fixed in version 4.2.0
2026-02-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.