CVE-2025-57810

jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

State: Published
Severity: 8.7 High
Published: Aug 26, 2025
Updated: Aug 26, 2025
Reserved: Aug 20, 2025

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
jsPDFparallax	< 3.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.