Vulnerability · Published Aug 26, 2025 · Assigned by GitHub_M

CVE-2025-57810jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

High 8.7

In plain English

A high-severity improper input validation in jsPDF from parallax. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.7%top 47.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	jspdf	3.0.2	GHSA-8mvj-3j78-4qmw

Affected products (as reported)

Vendor	Product	Versions
parallax	jsPDF	< 3.0.2

Weakness: CWE-20, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/parallax/jsPDF/security/advisories/GHSA-8mvj-3j78-4qmw x_refsource_CONFIRM
https://github.com/parallax/jsPDF/pull/3880 x_refsource_MISC
https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9 x_refsource_MISC
https://github.com/parallax/jsPDF/releases/tag/v3.0.2 x_refsource_MISC