npmPackage

jspdf

15 known vulnerabilities (2 critical, 8 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release: 4.2.1 (Mar 17, 2026): no advisory affects it
Newest unaffected release: 4.2.1 (Mar 17, 2026), the latest release
Advisories: 15 · 2 critical, 8 high, 4 medium

Weekly downloads: 20.2M
Dependents: 796
Releases: 34 since 1.0.272 (May 19, 2015)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-31938
Affects 1.0.272 to 4.2.0 (4.2.1 is outside it)
CVE-2026-31898
Affects 1.0.272 to 4.2.0 (4.2.1 is outside it)
CVE-2026-25940
Affects 1.0.272 to 4.1.0 (4.2.0 is outside it)
CVE-2026-25755
Affects 1.0.272 to 4.1.0 (4.2.0 is outside it)
CVE-2026-25535
Affects 1.0.272 to 4.1.0 (4.2.0 is outside it)
CVE-2026-24040
Affects 1.0.272 to 4.0.0 (4.1.0 is outside it)
CVE-2026-24043
Affects 1.0.272 to 4.0.0 (4.1.0 is outside it)
CVE-2026-24133
Affects 1.0.272 to 4.0.0 (4.1.0 is outside it)
CVE-2026-24737
Affects 1.0.272 to 4.0.0 (4.1.0 is outside it)
CVE-2025-68428
Affects 1.0.272 to 3.0.4 (4.0.0 is outside it)
CVE-2025-57810
Affects 1.0.272 to 3.0.1 (3.0.2 is outside it)
CVE-2025-29907
Affects 1.0.272 to 3.0.0 (3.0.1 is outside it)

Show all 15 advisoriesShow fewer advisories

CVE-2021-23353
Affects 1.0.272 to 2.3.0 (2.3.1 is outside it)
CVE-2020-7690
Affects 1.0.272 to 1.5.3 (2.0.0 is outside it)
CVE-2020-7691
Affects 1.0.272 to 1.5.3 (2.0.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

CVE-2026-31938Critical 9.6
jsPDF has HTML Injection in New Window paths
Affected: fixed in 4.2.1.
Fixed in 4.2.1 (released Mar 17, 2026, 1 day before disclosure).
The latest release, 4.2.1, is not affected.
30% of jspdf downloads last week were affected versions (6.9M).
CVE-2026-31898High 8.1
jsPDF has a PDF Object Injection via FreeText color
Affected: fixed in 4.2.1.
Fixed in 4.2.1 (released Mar 17, 2026, 1 day before disclosure).
The latest release, 4.2.1, is not affected.
30% of jspdf downloads last week were affected versions (6.9M).
CVE-2026-25940High 8.1
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
Affected: fixed in 4.2.0.
Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
25% of jspdf downloads last week were affected versions (5.9M).
CVE-2026-25755High 8.1
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
Affected: fixed in 4.2.0.
Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
25% of jspdf downloads last week were affected versions (5.9M).
CVE-2026-25535High 8.7
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
Affected: fixed in 4.2.0.
Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
25% of jspdf downloads last week were affected versions (5.9M).
CVE-2026-24040Medium 6.3
jsPDF has a Shared State Race Condition in addJS Plugin
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
24% of jspdf downloads last week were affected versions (5.7M).
CVE-2026-24043Medium 6.9
jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
24% of jspdf downloads last week were affected versions (5.7M).
CVE-2026-24133High 8.7
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
24% of jspdf downloads last week were affected versions (5.7M).
CVE-2026-24737High 8.1
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
Affected: fixed in 4.1.0.
Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure).
The latest release, 4.2.1, is not affected.
24% of jspdf downloads last week were affected versions (5.7M).
CVE-2025-68428Critical 9.2
jsPDF has Local File Inclusion/Path Traversal vulnerability
Affected: fixed in 4.0.0.
Fixed in 4.0.0 (released Jan 3, 2026, 2 days before disclosure).
The latest release, 4.2.1, is not affected.
22% of jspdf downloads last week were affected versions (5.2M).
CVE-2025-57810High 8.7
jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)
Affected: fixed in 3.0.2.
Fixed in 3.0.2 (released Aug 26, 2025, the day of disclosure).
The latest release, 4.2.1, is not affected.
13% of jspdf downloads last week were affected versions (3.1M).
CVE-2025-29907High 8.7
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
Affected: fixed in 3.0.1.
Fixed in 3.0.1 (released Mar 18, 2025, the day of disclosure).
The latest release, 4.2.1, is not affected.
12% of jspdf downloads last week were affected versions (2.7M).
CVE-2021-23353Medium 5.9
Regular Expression Denial of Service (ReDoS)
Affected: fixed in 2.3.1.
Fixed in 2.3.1 (released Mar 9, 2021, the day of disclosure).
The latest release, 4.2.1, is not affected.
1% of jspdf downloads last week were affected versions (222K).
CVE-2020-7690Unrated
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released Aug 11, 2020, 36 days after disclosure).
The latest release, 4.2.1, is not affected.
0.8% of jspdf downloads last week were affected versions (180.6K).
CVE-2020-7691Medium 6.3
Cross-site Scripting (XSS)
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released Aug 11, 2020, 36 days after disclosure).
The latest release, 4.2.1, is not affected.
0.8% of jspdf downloads last week were affected versions (180.6K).