CVE-2026-25535
High · 7.5CVSS
7.5
EPSS
1.0%
Published
Feb 19, 2026
CISA due date
—
The record
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jspdf | 0 | 4.2.0 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r1 |
Related vulnerabilities
- GHSA-67pg-wm7f-q7fj jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions Same vulnerability
- CVE-2026-31938 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- CVE-2026-31898 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf
- GHSA-wfv2-pwc8-crg5 jsPDF has HTML Injection in New Window paths Also affects jspdf
- GHSA-7x6v-j9x4-qf24 jsPDF has a PDF Object Injection via FreeText color Also affects jspdf
- GHSA-p5xg-68wr-hm3m jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution… Also affects jspdf
- GHSA-9vjf-qc39-jprp jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method Also affects jspdf
- CVE-2026-25940 jsPDF is a library to generate PDFs in JavaScript. Also affects jspdf