# jspdf (npm) vulnerabilities 15 known vulnerabilities (2 critical, 8 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.1 (Mar 17, 2026): no advisory affects it - Newest unaffected release: 4.2.1 (Mar 17, 2026), the latest release - Weekly downloads: 20.2M - Dependents: 796 - Releases: 34 since 1.0.272 (May 19, 2015) - Registry: https://www.npmjs.com/package/jspdf - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-31938: 1.0.272 to 4.2.0 (4.2.1 is outside it) - CVE-2026-31898: 1.0.272 to 4.2.0 (4.2.1 is outside it) - CVE-2026-25940: 1.0.272 to 4.1.0 (4.2.0 is outside it) - CVE-2026-25755: 1.0.272 to 4.1.0 (4.2.0 is outside it) - CVE-2026-25535: 1.0.272 to 4.1.0 (4.2.0 is outside it) - CVE-2026-24040: 1.0.272 to 4.0.0 (4.1.0 is outside it) - CVE-2026-24043: 1.0.272 to 4.0.0 (4.1.0 is outside it) - CVE-2026-24133: 1.0.272 to 4.0.0 (4.1.0 is outside it) - CVE-2026-24737: 1.0.272 to 4.0.0 (4.1.0 is outside it) - CVE-2025-68428: 1.0.272 to 3.0.4 (4.0.0 is outside it) - CVE-2025-57810: 1.0.272 to 3.0.1 (3.0.2 is outside it) - CVE-2025-29907: 1.0.272 to 3.0.0 (3.0.1 is outside it) - CVE-2021-23353: 1.0.272 to 2.3.0 (2.3.1 is outside it) - CVE-2020-7690: 1.0.272 to 1.5.3 (2.0.0 is outside it) - CVE-2020-7691: 1.0.272 to 1.5.3 (2.0.0 is outside it) ## Advisories (15) ### [CVE-2026-31938](https://cve.now/CVE-2026-31938): jsPDF has HTML Injection in New Window paths - Severity: Critical 9.6 - Published: Mar 18, 2026 - Affected: fixed in 4.2.1. - Fixed in 4.2.1 (released Mar 17, 2026, 1 day before disclosure). - The latest release, 4.2.1, is not affected. - 30% of jspdf downloads last week were affected versions (6.9M). ### [CVE-2026-31898](https://cve.now/CVE-2026-31898): jsPDF has a PDF Object Injection via FreeText color - Severity: High 8.1 - Published: Mar 18, 2026 - Affected: fixed in 4.2.1. - Fixed in 4.2.1 (released Mar 17, 2026, 1 day before disclosure). - The latest release, 4.2.1, is not affected. - 30% of jspdf downloads last week were affected versions (6.9M). ### [CVE-2026-25940](https://cve.now/CVE-2026-25940): jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) - Severity: High 8.1 - Published: Feb 19, 2026 - Affected: fixed in 4.2.0. - Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 25% of jspdf downloads last week were affected versions (5.9M). ### [CVE-2026-25755](https://cve.now/CVE-2026-25755): jsPDF has PDF Object Injection via Unsanitized Input in addJS Method - Severity: High 8.1 - Published: Feb 19, 2026 - Affected: fixed in 4.2.0. - Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 25% of jspdf downloads last week were affected versions (5.9M). ### [CVE-2026-25535](https://cve.now/CVE-2026-25535): jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - Severity: High 8.7 - Published: Feb 19, 2026 - Affected: fixed in 4.2.0. - Fixed in 4.2.0 (released Feb 19, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 25% of jspdf downloads last week were affected versions (5.9M). ### [CVE-2026-24040](https://cve.now/CVE-2026-24040): jsPDF has a Shared State Race Condition in addJS Plugin - Severity: Medium 6.3 - Published: Feb 2, 2026 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 24% of jspdf downloads last week were affected versions (5.7M). ### [CVE-2026-24043](https://cve.now/CVE-2026-24043): jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation) - Severity: Medium 6.9 - Published: Feb 2, 2026 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 24% of jspdf downloads last week were affected versions (5.7M). ### [CVE-2026-24133](https://cve.now/CVE-2026-24133): jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - Severity: High 8.7 - Published: Feb 2, 2026 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 24% of jspdf downloads last week were affected versions (5.7M). ### [CVE-2026-24737](https://cve.now/CVE-2026-24737): jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution - Severity: High 8.1 - Published: Feb 2, 2026 - Affected: fixed in 4.1.0. - Fixed in 4.1.0 (released Feb 2, 2026, the day of disclosure). - The latest release, 4.2.1, is not affected. - 24% of jspdf downloads last week were affected versions (5.7M). ### [CVE-2025-68428](https://cve.now/CVE-2025-68428): jsPDF has Local File Inclusion/Path Traversal vulnerability - Severity: Critical 9.2 - Published: Jan 5, 2026 - Affected: fixed in 4.0.0. - Fixed in 4.0.0 (released Jan 3, 2026, 2 days before disclosure). - The latest release, 4.2.1, is not affected. - 22% of jspdf downloads last week were affected versions (5.2M). ### [CVE-2025-57810](https://cve.now/CVE-2025-57810): jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS) - Severity: High 8.7 - Published: Aug 26, 2025 - Affected: fixed in 3.0.2. - Fixed in 3.0.2 (released Aug 26, 2025, the day of disclosure). - The latest release, 4.2.1, is not affected. - 13% of jspdf downloads last week were affected versions (3.1M). ### [CVE-2025-29907](https://cve.now/CVE-2025-29907): jsPDF Bypass Regular Expression Denial of Service (ReDoS) - Severity: High 8.7 - Published: Mar 18, 2025 - Affected: fixed in 3.0.1. - Fixed in 3.0.1 (released Mar 18, 2025, the day of disclosure). - The latest release, 4.2.1, is not affected. - 12% of jspdf downloads last week were affected versions (2.7M). ### [CVE-2021-23353](https://cve.now/CVE-2021-23353): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.9 - Published: Mar 9, 2021 - Affected: fixed in 2.3.1. - Fixed in 2.3.1 (released Mar 9, 2021, the day of disclosure). - The latest release, 4.2.1, is not affected. - 1% of jspdf downloads last week were affected versions (222K). ### [CVE-2020-7690](https://cve.now/CVE-2020-7690): All affected versions \<2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). - Severity: Unrated - Published: Jul 6, 2020 - Affected: fixed in 2.0.0. - Fixed in 2.0.0 (released Aug 11, 2020, 36 days after disclosure). - The latest release, 4.2.1, is not affected. - 0.8% of jspdf downloads last week were affected versions (180.6K). ### [CVE-2020-7691](https://cve.now/CVE-2020-7691): Cross-site Scripting (XSS) - Severity: Medium 6.3 - Published: Jul 6, 2020 - Affected: fixed in 2.0.0. - Fixed in 2.0.0 (released Aug 11, 2020, 36 days after disclosure). - The latest release, 4.2.1, is not affected. - 0.8% of jspdf downloads last week were affected versions (180.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/jspdf Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.