Read the docs
TI-2025-21292 Aliases CVE-2025-29907GHSA-w532-jxjh-hjhj

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00699 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed jsPDF (parallax): 3.0.1jspdf (npm): 3.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parallaxjsPDFbefore 3.0.13.0.1Patch availableCNA
—jspdf (npm)before 3.0.13.0.1Patch availableGHSA-w532-jxjh-hjhj
  • jsPDF Vendorparallax Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
  • jspdf (npm) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-w532-jxjh-hjhj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*before 3.0.1Vulnerableparallax
  • cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:* Versions before 3.0.1 Vulnerable ·parallax

Remediation

  • Fix · CNA jsPDF (parallax) Fixed in 3.0.1
  • Fix · GHSA-w532-jxjh-hjhj jspdf (npm) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29907
  2. 2026-10-03 Alias added: GHSA-w532-jxjh-hjhj

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-20644 jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions CVSS 4.0HIGH 8.7
  • TI-2025-35693 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS) CVSS 4.0HIGH 8.7
  • TI-2025-41976 jsPDF has Local File Inclusion/Path Traversal vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-24484 jsPDF has HTML Injection in New Window paths CVSS 3.1CRITICAL 9.6
  • TI-2026-20823 jsPDF has PDF Object Injection via Unsanitized Input in addJS Method CVSS 3.1HIGH 8.8
  • TI-2026-19451 jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder CVSS 4.0HIGH 8.7
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences