8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25535

CVE-2026-25535: jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: html. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25535

CVE-2026-25535:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jspdf	npm	< 4.2.0	4.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the jsPDF library, caused by uncontrolled resource allocation when processing GIF images. The root cause lies within the omggif.js library, specifically in the decodeAndBlitFrameBGRA and decodeAndBlitFrameRGBA functions of the GifReader. These functions would calculate the memory needed for a GIF frame based on its width and height as specified in the image headers. The vulnerability existed because there was no validation of these dimensions, allowing an attacker to craft a GIF with extremely large dimensions. When the addImage or html methods of jsPDF were used to process such a malicious GIF, these underlying functions would attempt to allocate an unreasonable amount of memory, leading to an out-of-memory error and crashing the application. The patch introduces a size check, throwing an error if the required memory exceeds 512MB, thus preventing the denial of service.

Vulnerable functions

GifReader.decodeAndBlitFrameBGRA

src/libs/omggif.js

This function is responsible for decoding GIF frames. Prior to the patch, it lacked a size validation check for the image dimensions. A malicious GIF with excessively large width and height headers would cause this function to attempt a huge memory allocation, leading to a denial of service.

GifReader.decodeAndBlitFrameRGBA

src/libs/omggif.js

Similar to `decodeAndBlitFrameBGRA`, this function for decoding GIF frames was missing a crucial size check. This allowed an attacker to trigger a denial of service by providing a GIF with malicious dimensions, causing excessive memory allocation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.