CVE-2026-24133: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24133 is a Denial of Service (DoS) vulnerability in the jsPDF JavaScript library, specifically in the BMPDecoder component's handling of the addImage method. When user-controlled input is passed unsanitized to addImage, a crafted BMP file with excessively large width and/or height header values triggers unbounded memory allocation, causing out-of-memory errors and application crashes. The vulnerability affects jsPDF versions up to and including 4.0.0 (npm package), and was disclosed on February 2, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) combined with allocation of resources without limits or throttling (CWE-770, CWE-400) in src/libs/BMPDecoder.js. The parseBGR function computed a buffer size as width * height * 4 directly from BMP header fields without any upper-bound check, then allocated a Uint8Array of that size — allowing an attacker to trigger allocation of gigabytes of memory with a trivially small payload. The attack vector is network-based and requires no user interaction; the only precondition is that the application exposes a code path where user-supplied image data or URLs are passed to addImage or the html method without prior sanitization. The fix (commit ae4b93f) added a 512 MB cap: if width * height * 4 > 512 * 1024 * 1024, an error is thrown before allocation (GitHub Commit, GitHub Advisory).

Successful exploitation causes the host process to exhaust available memory, resulting in an application crash or unresponsive state — a complete availability impact with no confidentiality or integrity consequences. Any web application or server-side Node.js service that allows users to supply image data to jsPDF's addImage or html methods is at risk of being rendered unavailable to all legitimate users. Downstream products incorporating jsPDF as a dependency — including IBM Cloud Pak for Business Automation, IBM API Connect, IBM Instana Observability (OnPrem), and Cloudera Data Platform Private Cloud Base — are also affected (GitHub Advisory, IBM CP4BA Bulletin).

A proof-of-concept exploit is publicly referenced in the GitHub security advisory, demonstrating the attack via a crafted BMP payload passed to doc.addImage(). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), placing it in the 12th percentile for exploitation likelihood. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a web application or Node.js service using jsPDF ≤ 4.0.0 that accepts user-supplied image data or URLs and passes them to addImage or the html method without sanitization.
2. Craft a malicious BMP file: Construct a BMP file with a valid BMP header but with the width and/or height fields set to extremely large values (e.g., 0x7FFF × 0x7FFF), such that width * height * 4 exceeds available system memory. The actual pixel data payload can be minimal.
3. Deliver the payload: Submit the crafted BMP as image input to the vulnerable application endpoint — for example, via a file upload form, an API parameter, or a URL reference that the server-side jsPDF instance will fetch and process.
4. Trigger DoS: The application calls doc.addImage(payload, "BMP", ...), which invokes BMPDecoder.parseBGR(). Without the size check present in ≥ 4.1.0, a Uint8Array of the computed size is allocated, exhausting process memory and causing an out-of-memory crash or hang, denying service to all users (GitHub Advisory, GitHub Commit).

• Logs: Application error logs showing JavaScript heap out of memory or RangeError: Invalid typed array length originating from jsPDF's BMPDecoder or addImage call stack; repeated process crashes or restarts in Node.js process managers (e.g., PM2, systemd).
• Network: Unusual upload requests containing small BMP files (few KB) to PDF-generation endpoints, particularly with Content-Type: image/bmp or base64-encoded BMP data in request bodies.
• Process: Sudden spike in memory consumption of the Node.js process to near-system limits followed by process termination; increased frequency of OOM killer events in Linux system logs (/var/log/syslog or dmesg).
• File System: Presence of small BMP files with anomalously large dimension values in upload directories or temporary storage used by the PDF generation service.

The primary remediation is to upgrade jsPDF to version 4.1.0 or later, which introduces a 512 MB buffer allocation cap in BMPDecoder.parseBGR() and throws an error for oversized inputs (jsPDF v4.1.0 Release). As a workaround for environments that cannot immediately upgrade, implement server-side validation to reject BMP files whose header-declared dimensions exceed a safe threshold before passing data to addImage. Additionally, consider restricting user-controlled input to addImage entirely, or running PDF generation in an isolated process with memory limits enforced at the OS level. IBM has released iFixes for affected products including Cloud Pak for Business Automation (April 2026), IBM API Connect, and IBM Instana Observability (IBM CP4BA Bulletin, IBM Instana Bulletin).

The vulnerability was reported by security researcher KarimTantawey and published by HackbrettXXX to the parallax/jsPDF repository on February 2, 2026, alongside fixes for three other security issues in the v4.1.0 release (jsPDF v4.1.0 Release). Security Online Info covered the release under the headline "PDF Poison: Popular JavaScript Library Patches Critical Injection and Crash Flaws," highlighting the bundled security fixes. Red Hat tracked the issue via Bugzilla (Bug 2436135) with medium severity, and Qualys added detection support (detection ID 5007338). No significant social media controversy or broad threat actor discussion has been observed.