CVE-2026-24133
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.57%
- CWE
- CWE-770
- Published
- 2026-02-02
- Last modified
- 2026-03-12
Affected products
- parallax jsPDF
Weakness type
Related vulnerabilities
- CVE-2026-45769 — ikev2: unbounded client transform storage can lead to resource exhaustion
- CVE-2026-45768 — Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
- CVE-2026-45766 — Suricata nfs: unbounded stateful structures can lead to resource exhaustion
- CVE-2026-45765 — Suricata dnp3: unbounded reassembly can lead to resource exhaustion
- CVE-2026-88012 — Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- CVE-2026-45763 — Suricata lua: sandbox allocation limit not enforced for new allocations
- CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout