High severity · published Mar 18, 2025
CVE-2025-29907
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jsPDF · parallax
< 3.0.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-29907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-29907
Patch
https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df
Exploit
https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj
More from jsPDF
8.8
CVE-2026-25755
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
8.1
CVE-2026-25940
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
8.1
CVE-2026-24737
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
7.5
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
7.5
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability