CVE-2025-29907: parall jspdf Uncontrolled Resource Consumption

Vulnerability summary

CVE-2025-29907 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in parall jspdf. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-03-2025
   PublishedVulnerability first disclosed.
2. 18-03-2025
   Last modifiedVulnerability information updated.

Description

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.