CVE-2025-29907

HIGH

jsPDF < 3.0.1 - Denial of Service via addImage Method

Title source: llm
STIX 2.1

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0065
EPSS Percentile 46.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-770
Status published
Products (2)
npm/jspdf 0 - 3.0.1npm
parall/jspdf < 3.0.1
Published Mar 18, 2025
Tracked Since Feb 18, 2026