Medium severity · published Feb 2, 2026
CVE-2026-24133
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in jsPDF@4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsPDF · parallax
< 4.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24133
Patch
https://github.com/parallax/jsPDF/commit/ae4b93f76d8fc1baa5614bd5fdb5d174c3b85f0d
Release Notes
https://github.com/parallax/jsPDF/releases/tag/v4.1.0
Exploit
https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c
More from jsPDF
8.8
CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
8.1
CVE-2026-25940
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
8.1
CVE-2026-24737
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
7.5
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
7.5
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability