Skip to content
Heist/ feed
Back to feed
High

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

Type: advisorySources: OSV

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-29907
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 15:19 UTC · Revision 1

Source evidence

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

core-osv · Original source

Published 18 Mar 2025, 18:40 UTC

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

osv:CVE-2025-29907
Complete source record
{
  "id": "06b97d5e1541517e010a06578bac544cf0a062a7fb80ce9f335b0007aa4c738d",
  "url": "https://osv.dev/vulnerability/CVE-2025-29907",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "jsPDF Bypass Regular Expression Denial of Service (ReDoS)",
    "summary": "jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.",
    "evidence": "osv:CVE-2025-29907",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-29907",
      "aliases": [
        "CVE-2025-29907",
        "GHSA-w532-jxjh-hjhj"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/parallax/jspdf",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "57cbe9499dc9922c1a8dbdd225f9c45364653324"
                },
                {
                  "fixed": "b167c43c27c466eb914b927885b06073708338df"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.0.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b167c43c27c466eb914b927885b06073708338df"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.0.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.0",
            "v2.3.1",
            "v2.3.0",
            "v2.2.0",
            "v2.1.1",
            "v2,1,0",
            "v2.0.0",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.1",
            "v1.4.0",
            "v.1.4.0",
            "v1.3.5",
            "1.3.4",
            "v1.3.4",
            "v1.3.3",
            "v1.3.0",
            "v1.2.61",
            "v1.2.60",
            "1.1.135",
            "v1.0.272",
            "v1.0.178",
            "v1.0.150",
            "v1.0.138",
            "v1.0.119",
            "v1.0.116",
            "v1.0.115",
            "v1.0.106",
            "v0.9.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29907.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.712843282Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29907.json",
        "https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-29907",
        "https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400",
          "CWE-770"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29907.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-29907",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 496764,
  "published_at": "2025-03-18T18:40:57.504+00:00"
}