CVE-2025-29907: jsPDF Bypass Regular Expression Denial of Service (ReDoS)
Description
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.
Classification
CVE ID: CVE-2025-29907
CVSS Base Severity: HIGH
CVSS Base Score: 8.7
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Problem Types
CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or ThrottlingAffected Products
Vendor: parallax
Product: jsPDF
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 19.59% (scored less or equal to compared to others)
EPSS Date: 2025-04-16 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-29907https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj
https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df