CVE-2026-24133

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24133

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

j

sPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in [email protected].

References
Link Resource
https://github.com/parallax/jsPDF/commit/ae4b93f76d8fc1baa5614bd5fdb5d174c3b85f0d Patch
https://github.com/parallax/jsPDF/releases/tag/v4.1.0 Release Notes
https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c Vendor Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*
History

18 Feb 2026, 14:41

Type Values Removed Values Added
First Time Parall jspdf
Parall
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
Summary
  • (es) jsPDF es una biblioteca para generar PDFs en JavaScript. Anterior a la 4.1.0, el control del usuario sobre el primer argumento del método addImage resulta en denegación de servicio. Si se le da la posibilidad de pasar datos de imagen o URLs no saneados al método addImage, un usuario puede proporcionar un archivo BMP malicioso que resulta en errores de falta de memoria y denegación de servicio. Los archivos BMP maliciosos tienen entradas grandes de ancho y/o alto en sus cabeceras, lo que lleva a una asignación de memoria excesiva. El método html también se ve afectado. La vulnerabilidad ha sido corregida en [email protected].
CPE cpe:2.3:a:parall:jspdf:*:*:*:*:*:node.js:*:*
References () https://github.com/parallax/jsPDF/commit/ae4b93f76d8fc1baa5614bd5fdb5d174c3b85f0d - () https://github.com/parallax/jsPDF/commit/ae4b93f76d8fc1baa5614bd5fdb5d174c3b85f0d - Patch
References () https://github.com/parallax/jsPDF/releases/tag/v4.1.0 - () https://github.com/parallax/jsPDF/releases/tag/v4.1.0 - Release Notes
References () https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c - () https://github.com/parallax/jsPDF/security/advisories/GHSA-95fx-jjr5-f39c - Vendor Advisory, Exploit

02 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-02 23:16

Updated : 2026-02-18 14:41

NVD link : CVE-2026-24133

Mitre link : CVE-2026-24133

CVE.ORG link : CVE-2026-24133

JSON object : View

Products Affected

parall

CWE
CWE-770

Allocation of Resources Without Limits or Throttling