p PatchFirst

CVE-2025-57810

CVE-2025-57810 · jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • jspdf

    Versions
    • < 3.0.2: Affected

    No fix published

  • jspdf npm

    Affected ranges
    • SEMVER: < 3.0.2

    Update to 3.0.2

Original sources

Check your server →