CVE-2026-24040: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24040 is a shared state race condition vulnerability in the addJS method of the jsPDF Node.js library, leading to cross-user data leakage. It affects jsPDF versions up to and including 4.0.0 (npm package). The vulnerability was discovered by KarimTantawey, published to the GitHub Advisory Database on February 2, 2026, and assigned GHSA-cjw8-79x6-5cj4. It carries a CVSS v4.0 base score of 6.3 (Medium) and a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, jsPDF Advisory).

The root cause is improper synchronization (CWE-362, CWE-820) in src/modules/javascript.js, where the variables text, jsNamesObj, and jsJsObj were declared at module scope rather than function scope. In a concurrent Node.js server environment, all jsPDF instances share this single module-level text variable. When two requests call addJS() concurrently, the second call overwrites the shared text variable before the first instance calls save(), causing the first user's PDF to embed the second user's JavaScript payload. The fix, committed in parallax/jsPDF@2863e5c, moves these variables inside the addJS function scope to ensure per-invocation isolation (GitHub Advisory, Patch Commit).

Successful exploitation results in cross-user data leakage (CWE-200): a PDF generated for one user may contain JavaScript content — including sensitive data such as authentication tokens, session identifiers, or user-specific secrets — intended for a different user. This is a confidentiality and integrity impact limited to the vulnerable system, with no availability impact and no lateral movement potential. The risk is highest in multi-tenant or high-concurrency server-side PDF generation services where sensitive data is embedded via addJS() (GitHub Advisory, jsPDF Advisory).

There is no evidence of active in-the-wild exploitation. One proof-of-concept is referenced via the GitHub security advisory, demonstrating the race condition with a simple two-instance code example. The EPSS score is approximately 0.012–0.015% (3rd percentile), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog, and no threat actor attribution has been reported (GitHub Advisory, jsPDF Advisory).

1. Identify a vulnerable target: Locate a web application using jsPDF ≤ 4.0.0 in a Node.js server-side environment that calls addJS() to embed user-specific JavaScript content into generated PDFs.
2. Trigger concurrent PDF generation requests: As an attacker (or by timing a legitimate request), send two or more simultaneous PDF generation requests to the server — one as the attacker (User B) and one as the victim (User A) — so both invoke addJS() nearly simultaneously.
3. Race condition exploitation: The attacker's addJS() call (User B) overwrites the shared module-scoped text variable after the victim's addJS() call (User A) but before User A's save() executes.
4. Obtain the victim's PDF: User A's generated PDF now contains User B's JavaScript payload. Conversely, if the attacker can observe or receive User A's PDF (e.g., via a shared link or server misconfiguration), they may also obtain User A's sensitive JavaScript content embedded in their own PDF.
5. Extract sensitive data: Review the received PDF's embedded JavaScript for sensitive information such as tokens, session data, or user-specific secrets (GitHub Advisory, jsPDF Advisory).

• Logs: Server-side application logs showing near-simultaneous PDF generation requests from different users within the same Node.js process; unexpected JavaScript content appearing in PDF generation audit logs that does not match the requesting user's session data.
• File System: Generated PDF files containing embedded JavaScript (/JS or /JavaScript PDF dictionary entries) with content mismatched to the intended recipient — detectable by parsing PDF structure and comparing embedded scripts against expected per-user values.
• Application Behavior: User reports of receiving PDFs with unexpected or unfamiliar JavaScript content; discrepancies between the JavaScript payload a user submitted and what appears in their downloaded PDF.

Upgrade jsPDF to version 4.1.0 (npm: jspdf@4.1.0) or later, which moves the shared variables into function scope and eliminates the race condition (jsPDF Release, Patch Commit). If an immediate upgrade is not possible, avoid using the addJS() method in concurrent server-side environments, or serialize PDF generation requests using a queue to ensure sequential processing. IBM has also released patches for affected products including IBM Cloud Pak for Business Automation, IBM Observability with Instana (OnPrem), IBM API Connect, and Cloudera Data Platform Private Cloud Base (IBM CP4BA Advisory, IBM Instana Advisory).

The vulnerability was reported by security researcher KarimTantawey and published by HackbrettXXX via the jsPDF GitHub security advisory process. Red Hat tracked the issue via Bugzilla (Bug 2436133) and classified it as medium severity. IBM issued multiple security bulletins addressing the vulnerability across several enterprise products. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability disclosure channels (jsPDF Advisory, Red Hat Bugzilla).