p PatchFirst

CVE-2025-29907

CVE-2025-29907 · jsPDF Bypass Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • jspdf

    Versions
    • < 3.0.1: Affected

    No fix published

  • jspdf npm

    Affected ranges
    • SEMVER: < 3.0.1

    Update to 3.0.1

Original sources

Check your server →