CVE-2026-24040: jsPDF Information Disclosure Vulnerability

CVE-2026-24040 Overview

CVE-2026-24040 is a Race Condition vulnerability in jsPDF, a popular JavaScript library used to generate PDF documents. Prior to version 4.1.0, the addJS method in the jsPDF Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When deployed in concurrent environments such as Node.js web servers, this shared variable creates a race condition where multiple simultaneous requests can overwrite each other's data, resulting in cross-user data leakage.

Critical Impact

PDFs generated for one user may contain JavaScript payloads and sensitive data intended for another user, creating serious privacy and security implications in multi-tenant server environments.

Affected Products

• jsPDF versions prior to 4.1.0
• Node.js server-side deployments using jsPDF
• Client-side implementations with concurrent PDF generation

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-24040 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-24040

Vulnerability Analysis

This vulnerability stems from improper handling of shared state in a concurrent execution environment. The addJS method in jsPDF's Node.js build stores JavaScript content in a module-level variable that persists across all requests processed by the application. In server-side deployments where multiple users may request PDF generation simultaneously, this architectural flaw creates a Time-of-Check Time-of-Use (TOCTOU) race condition.

When User A initiates PDF generation with specific JavaScript content, that content is stored in the shared variable. If User B initiates their own PDF generation before User A's document is fully created, User B's JavaScript payload overwrites User A's content. The resulting PDF for User A then contains User B's data, effectively leaking potentially sensitive information across user boundaries.

Root Cause

The root cause is the use of a module-scoped variable to store request-specific data in a stateless, concurrent environment. This design pattern violates the principle of request isolation, where each request should maintain its own independent state. The shared text variable acts as a global singleton, creating an inherent race condition when concurrent requests access and modify it.

Attack Vector

The vulnerability is exploitable via network access in server-side deployments. An attacker does not need authentication or special privileges to trigger the race condition. The attack requires precise timing—the attacker must submit a PDF generation request that overlaps with another user's request window. While this requires some coordination, high-traffic servers naturally create conditions where race conditions are more likely to occur.

In a practical attack scenario, a malicious actor could repeatedly submit PDF generation requests to a vulnerable server, attempting to intercept sensitive JavaScript payloads from other users' documents. This is particularly concerning for applications that embed user-specific data, authentication tokens, or tracking scripts in generated PDFs.

Detection Methods for CVE-2026-24040

Indicators of Compromise

• Unexpected JavaScript content appearing in generated PDF documents
• User reports of receiving PDF files containing data or scripts intended for other users
• Audit logs showing PDF generation requests with mismatched user identifiers and content
• Anomalous patterns in PDF generation timing indicating potential exploitation attempts

Detection Strategies

• Implement content validation checks on generated PDFs before delivery to verify JavaScript payload integrity
• Add request correlation logging that tags JavaScript content with unique request identifiers throughout the generation lifecycle
• Monitor for unusual spikes in concurrent PDF generation requests that could indicate exploitation attempts
• Deploy application performance monitoring to detect race condition symptoms such as unexpected variable state changes

Monitoring Recommendations

• Enable verbose logging for the addJS method invocations with request context correlation
• Implement real-time alerting for PDF content validation failures
• Monitor server concurrency metrics and correlate with PDF generation anomalies
• Conduct periodic security audits of generated PDFs in staging environments to detect data leakage

How to Mitigate CVE-2026-24040

Immediate Actions Required

• Upgrade jsPDF to version 4.1.0 or later immediately
• Audit any server-side PDF generation code that uses the addJS method for potential exposure
• Review logs for any indication that data leakage may have already occurred
• Implement temporary rate limiting on PDF generation endpoints if immediate upgrade is not possible

Patch Information

The vulnerability has been fixed in jsPDF version 4.1.0. The fix addresses the shared state issue by ensuring JavaScript content is scoped to individual document instances rather than stored in a module-level variable. Users should upgrade to the patched version as the primary remediation.

For reference, the fix details are available in the GitHub Commit and the jsPDF v4.1.0 Release. Additional vulnerability details can be found in the GitHub Security Advisory GHSA-cjw8-79x6-5cj4.

Workarounds

• Serialize PDF generation requests using a queue system to prevent concurrent execution of the addJS method
• Implement request isolation by spawning separate worker processes for each PDF generation request
• Avoid using the addJS method entirely until upgrade is complete, if JavaScript embedding is not critical
• Deploy server-side request throttling to reduce the likelihood of race condition exploitation

# Upgrade jsPDF to the patched version
npm update jspdf@4.1.0

# Verify the installed version
npm list jspdf