CVE-2026-24133: jsPDF Denial of Service Vulnerability via Unvalidated BMP Dimensions
Summary
CVE-2026-24133: jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder. Affects jspdf versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsPDF is a popular JavaScript library used for generating PDF documents in web applications. It allows developers to create complex PDFs programmatically, including adding images, text, and shapes. However, jsPDF has a vulnerability that can be exploited through the 'addImage' method, specifically when handling BMP image data. This vulnerability can lead to Denial of Service (DoS) attacks, affecting the performance and availability of applications using this library.
Vulnerability Detail
The vulnerability arises from user control over the first argument of the 'addImage' method, which allows the passing of unsanitized image data or URLs. If a user provides a malicious BMP file with excessively large width and/or height entries in its headers, it can cause the application to allocate excessive memory, leading to out of memory errors and resulting in Denial of Service. This issue also affects other methods such as 'html'.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install jspdf@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, sanitize image data or URLs before passing them to the 'addImage' method or any other affected methods. For example, you can validate the dimensions of the BMP file before using it:
function sanitizeBMPDimensions(bmpData) {
// Implement validation logic for BMP dimensions
// Return true if valid, false otherwise
}
if (sanitizeBMPDimensions(payload)) {
doc.addImage(payload, 'BMP', 0, 0, 100, 100);
} else {
console.error('Invalid BMP dimensions');
}
Conclusion
In summary, the jsPDF library has a critical vulnerability (CVE-2026-24133) that can lead to Denial of Service through unvalidated BMP dimensions. It is crucial to upgrade to version 4.1.0 or later to mitigate this risk. Additionally, implementing workarounds can help protect applications until an upgrade is possible.
See every vulnerability recorded for jspdf →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Versions of jsPDF up to and including 4.0.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If you cannot upgrade immediately, implement the suggested workaround to sanitize image data before passing it to the affected methods.
Exploiting this vulnerability can lead to Denial of Service, causing your application to crash or become unresponsive due to excessive memory usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
