chore(deps): update dependency jspdf to v3 [security] by renovate[bot] · Pull Request #218 · nethesis/nethvoice-report

renovate · 2026-07-26T01:50:20Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jspdf	`^2.1.1` → `^3.0.0`

jspdf vulnerable to Regular Expression Denial of Service (ReDoS)

CVE-2021-23353 / GHSA-57f3-gghm-9mhc

More information

Details

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

CVE-2025-29907 / GHSA-w532-jxjh-hjhj

More information

Details

Impact

User control of the first argument of the addImage method results in CPU utilization and denial of service.

If given the possibility to pass unsanitized image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service.

Other affected methods are: html, addSvgAsImage.

Example payload:

import { jsPDF } from "jpsdf" 

const doc = new jsPDF();
const payload = 'data:/charset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=scharset=s\x00base64,undefined';

const startTime = performance.now()

try {
 doc.addImage(payload, "PNG", 10, 40, 180, 180, undefined, "SLOW");
} catch (err) {
  const endTime = performance.now()
  console.log(`Call to doc.addImage took ${endTime - startTime} milliseconds`)
}

doc.save("a4.pdf");

Patches

The vulnerability was fixed in jsPDF 3.0.1. Upgrade to jspdf@>=3.0.1

Workarounds

Sanitize image urls before passing it to the addImage method or one of the other affected methods.

Credits

Researcher: Aleksey Solovev (Positive Technologies)

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

parallax/jsPDF (jspdf)

`v3.0.1`

Compare Source

This release fixes two security vulnerabilities:

Upgrade optional dependency canvg to 3.0.11
Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

`v3.0.0`

Compare Source

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

@nlqivision made their first contribution in #3812
@dependabot made their first contribution in #3826
@hainenber made their first contribution in #3827

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

`v2.5.2`

Compare Source

This release upgrades the Dompurify dependency to 2.5.4 with fixes a vulnerability with high severity: GHSA-mmhx-hmjr-r674.

It also upgrades fflate, core-js, and @babel/runtime to more recent versions.

What's Changed

Implement justifying for unicode fonts by @owenl131 in #3285
chore: update dompurify version 2.5.4 by @MarcioMeier in #3768
[Snyk] Upgrade fflate from 0.4.8 to 0.8.1 by @MrRio in #3666
[Snyk] Upgrade core-js from 3.6.5 to 3.33.0 by @MrRio in #3664
[Snyk] Upgrade @babel/runtime from 7.14.6 to 7.23.2 by @MrRio in #3665

`v2.5.1`

Compare Source

This release fixes two security related issues.

#3348: Check integrity when loading the pdfobject lib from CDN in calls to output('pdfobjectnewwindow')
#3368: Fix inefficient regular expression in setDisplayMode (CWE-1333)

`v2.5.0`

Compare Source

This release adds some minor new features and fixes some bugs, e.g. related to multiline text. Thanks to all contributors!

New Features

#3324 add getLineWidth function
#3294: add horizontalScale option to text function

Bugfixes

#3271: fix html function only rendering on the first invocation per document
#3304, #3295: fix context2D.closePath (now properly closes the path)
#3274: fix Acroform text fields with multiline text
#3281: fix textWithLink for multiline text
#3283: fix lineHeightFactor in text options having no effect
#3302: fixes to html typings
#3272: fix return type of save function in typings (promise overload)

`v2.4.0`

Compare Source

This release brings long awaited improvements to the html function and many other bugfixes and improvements. Thanks to all contributors!

#3203: Add width and windowWidth options to the html method, which will make correct scaling much easier.
#2977: Add/implement margin option for html method and add autoPaging option with two different modes: 'slice' and 'text'.
#3169: Add setLineDash and lineDashOffset to context2d.
#3039: Add rowStart and cellStart events and headerTextColor property to `table' function
#3132: Fix possibly negative line widths in context2d.
#3217: Fix setFont with fontWeight parameter for the built-in basic fonts
#3173: Fix violation of strict mode.
#3121: Improve addImage performance.
#3124: Allow to pass RGBA array to addImage.
#3135: Fix possibly imbalanced render target stack with form objects.
#3148: Add getDrawColor function to typings.
#3149: Fix font name escaping.
#3150: Throw an error when a zero size canvas is passed to addImage.
#3168: Fix word spacing after justified text.
#3215: Fix nullability of style arguments of geometry methods.
#3108: Complete the jsPDFOptions type in the typings.
#3119: Improve typings of the output function.

`v2.3.1`

Compare Source

Small bugfixes. Thanks to all contributors!

#3073: fix HTMLAnchorElement is not defined in file saver
#3078: fix exception in getTextDimensions() with maxWidth set
#3087: fix typings of table() function
#3091: fix ReDos vulnerability in addImage function
#3099: improve documentation of output function

`v2.3.0`

Compare Source

A couple of bugfixes, improved font handling and faster compression.

#3026: Fix alignment of links created with textWithLink
#3032: Fix alignment of table headers
#3062: Fix a bug where the options.flags parameter was ignored by the text method and consequently had the wrong defaults. This lead to garbled characters sometimes and was a regression to 1.5.3.
#3014: Add typings for internal events API
#3036: Support for numeric font weights and separation of font weight and font style
#3040: New fontFaces option for the html method that allows to add fonts similar CSS @font-face rules (no addFont calls required anymore). When supplied, fonts are resolved using the CSS 3 font loading algorithm.
#3054: replace pako library with fflate leading to faster compression and smaller bundle sizes.

`v2.2.0`

Compare Source

Incorporates many of the awesome contributions in context of the Hacktoberfest. Thanks to all the contributors!

#2944: Fix PDF compression. Special thanks to @markotaht!
#2959: Add support for PDF encryption. Special thanks to @owenl131!
#3018: Fix font name escaping
#3017: Fix dependencies in bower.json
#3014: Added typings for the events API
#2982: Bump dompurify version to fix cve-2020-7691
#2981: Fix Canvg import
#2946: Remove API, that was removed in the 2.0.0 release, also from the typings
#2943: Fix links on pages with different size than the first page
#2942: Fix multiline texts in combination with the maxWidth text option
#2933, #3021: Fix typings of exported types like ImageCompression
#2915: Fix documentation of text method
#2906: Fix "Could not load <module>" error messages
#2905: Fix usages of atob/btoa in Internet Explorer and "old Edge"

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update dependency jspdf to v3 [security]

11e5ed5

renovate Bot force-pushed the renovate/npm-jspdf-vulnerability branch from fd4480c to 11e5ed5 Compare August 15, 2026 03:52

Navigation Menu

Uh oh!

chore(deps): update dependency jspdf to v3 [security] - #218

chore(deps): update dependency jspdf to v3 [security]#218
renovate[bot] wants to merge 1 commit into
ns8from
renovate/npm-jspdf-vulnerability

renovate Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

jspdf vulnerable to Regular Expression Denial of Service (ReDoS)

Details

Severity

References

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

Details

Impact

Patches

Workarounds

Credits

Severity

References

Release Notes

New Contributors

What's Changed

New Features

Bugfixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 26, 2026 •

edited

Loading