8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24133

CVE-2026-24133: jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vulnerability has been fixed in jsPDF@4.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24133

CVE-2026-24133:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jspdf	npm	<= 4.0.0	4.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in the jsPDF library, caused by improper input validation of BMP image dimensions. The root cause lies in the BmpDecoder.parseBGR function within src/libs/BMPDecoder.js. This function reads the width and height from a BMP file's header and allocates memory for the image data without any size validation. An attacker can craft a BMP file with extremely large dimensions in the header, causing the new Uint8Array(len) allocation to fail and crash the process due to an out-of-memory error.

The primary entry point for this vulnerability is the addImage function, which is a public method of the jsPDF API. When a user provides image data to addImage, it identifies the image type and, for BMPs, delegates parsing to the BMPDecoder. The patch mitigates this vulnerability by adding a check in BmpDecoder.parseBGR to ensure the calculated memory allocation size does not exceed a reasonable limit (512MB), throwing an error if it does. Therefore, any runtime profile during exploitation would show calls to addImage leading to the vulnerable BmpDecoder.parseBGR function.

Vulnerable functions

BmpDecoder.parseBGR

src/libs/BMPDecoder.js

This function is responsible for parsing the pixel data of a BMP image. It calculates the required memory size based on the width and height specified in the image header. The vulnerability exists because, prior to the patch, this function did not validate these dimensions. An attacker could provide a BMP file with excessively large width and/or height values in its header, causing the application to attempt to allocate a massive amount of memory, which results in a Denial of Service (DoS).

addImage

src/modules/addimage.js

This is the user-facing API function for adding images to the PDF. It serves as the entry point for the vulnerability. When a user passes malicious BMP data to this function, it invokes the vulnerable `BmpDecoder.parseBGR` function to process the image, triggering the excessive memory allocation and causing a Denial of Service. The advisory explicitly names this function as an attack vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.