CVE-2026-25535: jsPDF Library DoS Vulnerability

CVE-2026-25535 Overview

CVE-2026-25535 is a Denial of Service (DoS) vulnerability affecting jsPDF, a popular JavaScript library used for generating PDF documents in web applications. The vulnerability exists in the addImage method and related functions, where unsanitized image data can trigger excessive memory allocation, leading to out-of-memory conditions and application crashes.

When an attacker supplies a maliciously crafted GIF file with exaggerated width and/or height values in its header metadata, the library attempts to allocate memory based on these dimensions without proper bounds checking. This Resource Exhaustion vulnerability (CWE-400) can be exploited remotely without authentication, making it particularly dangerous for web applications that accept user-uploaded images for PDF generation.

Critical Impact

Applications using jsPDF to process user-supplied images are vulnerable to denial of service attacks that can cause memory exhaustion and crash the hosting process, potentially affecting service availability for all users.

Affected Products

• jsPDF versions prior to 4.2.0
• Applications using the addImage method with user-controlled input
• Applications using the html method to render HTML content containing images

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-25535 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25535

Vulnerability Analysis

The vulnerability resides in the GIF image processing component of jsPDF, specifically within the omggif.js library that handles GIF decoding. When the addImage method receives a GIF file, it parses the image header to extract dimension information. The GIF file format stores width and height as 16-bit values in its header, allowing theoretical maximum dimensions of 65,535 x 65,535 pixels.

Prior to the fix, the library would calculate the required pixel buffer size by multiplying width by height without validating the result against reasonable memory limits. An attacker could craft a GIF with header values specifying enormous dimensions while keeping the actual file size small. When processed, the library attempts to allocate a Uint8Array buffer for num_pixels entries, which could request multiple gigabytes of memory for a single image.

Root Cause

The root cause is improper input validation in the GIF decoding functionality. The decodeAndBlitFrameBGRA function directly uses the width and height values parsed from the GIF header to calculate buffer sizes without implementing any sanity checks or maximum bounds. This allows malformed GIF files to trigger unbounded memory allocation, classifying this as a CWE-400 (Uncontrolled Resource Consumption) vulnerability.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated user who can influence image data passed to the vulnerable methods. Attack scenarios include:

1. Direct Upload: Uploading a malicious GIF through a web form that generates PDFs
2. URL Reference: Providing a URL pointing to a malicious GIF hosted on an attacker-controlled server
3. HTML Injection: Embedding a malicious image reference in HTML content processed by the html method

The attack requires no user interaction beyond triggering the PDF generation process and can be executed with a minimal payload (a few bytes for the GIF header).

   this.decodeAndBlitFrameBGRA = function(frame_num, pixels) {
     var frame = this.frameInfo(frame_num);
     var num_pixels = frame.width * frame.height;
+
+    if (num_pixels > 512 * 1024 * 1024) {
+      throw new Error("Image dimensions exceed 512MB, which is too large.");
+    }
+
     var index_stream = new Uint8Array(num_pixels); // At most 8-bit indices.
     GifReaderLZWOutputIndexStream(
       buf,

Source: GitHub Commit

Detection Methods for CVE-2026-25535

Indicators of Compromise

• Sudden memory spikes in Node.js processes or browser tabs running PDF generation
• Application crashes with "out of memory" or "heap limit exceeded" errors during PDF operations
• GIF files with abnormally small file sizes but large reported dimensions in metadata
• Repeated requests to PDF generation endpoints with GIF image parameters

Detection Strategies

• Monitor server-side memory usage patterns for anomalous spikes correlated with PDF generation requests
• Implement request logging that captures image dimension metadata before processing
• Set up alerting for Node.js process crashes with heap allocation failure messages
• Analyze uploaded GIF files for dimension/file-size ratio anomalies (small files claiming large dimensions)

Monitoring Recommendations

• Configure memory limits and monitoring for processes handling PDF generation workloads
• Implement request rate limiting on PDF generation endpoints to reduce DoS impact
• Set up synthetic monitoring for PDF generation functionality with baseline performance metrics
• Enable detailed logging for the addImage and html method calls including input source information

How to Mitigate CVE-2026-25535

Immediate Actions Required

• Upgrade jsPDF to version 4.2.0 or later immediately
• Audit application code to identify all locations using addImage or html methods with user input
• Implement input validation for image dimensions before passing data to jsPDF
• Consider implementing memory limits for PDF generation processes as defense in depth

Patch Information

The vulnerability has been addressed in jsPDF version 4.2.0. The fix adds a bounds check in the GIF decoding function that limits the maximum pixel count to 512MB (512 * 1024 * 1024 pixels), throwing an error if exceeded. The security patch is available in commit 2e5e156e284d92c7d134bce97e6418756941d5e6.

For detailed information, see the GitHub Security Advisory GHSA-67pg-wm7f-q7fj and Release Notes for v4.2.0.

Workarounds

• Validate image dimensions before passing to addImage by parsing image headers and rejecting oversized values
• Implement server-side image processing to re-encode user uploads before PDF generation
• Use allowlists for image sources rather than accepting arbitrary user-provided URLs
• Deploy PDF generation in isolated containers with strict memory limits to contain potential DoS impact

# Configuration example
# Update jsPDF to patched version
npm update jspdf@4.2.0

# Or install specific patched version
npm install jspdf@^4.2.0

# Verify installed version
npm list jspdf