jsPDF is a JavaScript library for generating PDFs. This vulnerability involves the misuse of width and height values in GIF headers when they are passed to the addImage method. An attacker can supply a malicious GIF with unusually large dimensions, causing jsPDF to attempt excessive memory allocation that eventually exhausts the process memory and stops the application. The result is a denial of service that compromises application availability. The weakness is categorized as CWE‑400 (Resource Exhaustion) and CWE‑770 (Out‑of‑Bound Resource Access).

The affected product is jsPDF, developed by parallax. All releases prior to version 4.2.0 are vulnerable. The vulnerability affects the addImage and html methods and applies to both client‑side and server‑side JavaScript deployments. If an application accepts user‑supplied image URLs or data that is passed to these methods, it is exposed to this denial‑of‑service condition.

The CVSS score of 8.7 indicates high severity. The EPSS score is below 1 %, indicating a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker needs the ability to supply image data or URLs to addImage or html, which is often allowed in web applications that process user content; no elevated privileges or authentication are required. The vendor’s commit history shows the issue was fixed in version 4.2.0, but until an upgrade or mitigation is applied, user‑controlled images can trigger memory exhaustion remotely.