Race Condition Vulnerability in jsPDF's addJS Method Leading to Cross-User Data Leakage
Summary
GHSA-cjw8-79x6-5cj4: jsPDF has Shared State Race Condition in addJS Plugin. Affects jspdf versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsPDF is a popular open-source library used for generating PDF documents in web applications. It allows developers to create complex PDF files programmatically, including text, images, and JavaScript content. The library is widely utilized in both client-side and server-side environments, making it essential for applications that require dynamic PDF generation. However, a recent vulnerability has been identified in the addJS method, which can lead to serious security issues when used concurrently.
Vulnerability Detail
The vulnerability arises from the addJS method in the jsPDF Node.js build, which uses a shared module-scoped variable to store JavaScript content. In a concurrent environment, such as a Node.js web server, this shared variable can be overwritten by simultaneous requests. As a result, the JavaScript content intended for one user may be replaced by that of another user, leading to Cross-User Data Leakage. This means that sensitive data intended for User A could be exposed in the PDF generated for User B, compromising user privacy and security.
How To Fix
Latest published version: 4.2.1 as of 23 Oct 2026
npm install jspdf@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install jspdf@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, avoid using the addJS method in concurrent server-side environments. Instead, process requests sequentially using a queue to ensure that one request completes before another begins. Here is an example of how to implement a simple queue:
const queue = [];
function processQueue() {
if (queue.length > 0) {
const nextRequest = queue.shift();
nextRequest();
}
}
function addToQueue(request) {
queue.push(request);
processQueue();
}
Conclusion
The jsPDF library has a significant vulnerability in its addJS method that can lead to Cross-User Data Leakage in concurrent environments. It is crucial to update to version 4.1.0 or later to mitigate this risk. If immediate updates are not possible, implementing request queuing can serve as a temporary workaround. Monitoring tools like Vulert can help ensure your application remains secure.
See every vulnerability recorded for jspdf →
FAQ
The vulnerability is a race condition in the addJS method that can lead to Cross-User Data Leakage.
It can cause sensitive JavaScript content intended for one user to be included in the PDF generated for another user.
Versions up to and including 4.0.0 are affected. The vulnerability is fixed in version 4.1.0 and later.
You should avoid using the addJS method in concurrent environments and process requests sequentially.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for jspdf.
