CVE-2026-25535: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25535 is a Denial of Service (DoS) vulnerability in jsPDF, a JavaScript library for generating PDFs, caused by insufficient validation of GIF image dimensions. Affecting all versions prior to 4.2.0, the flaw allows an unauthenticated remote attacker to trigger excessive memory allocation by supplying a crafted GIF file with oversized width/height header values to the addImage or html methods. The vulnerability was disclosed on February 19, 2026, with a fix released in jsPDF 4.2.0. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in the gif_support.js module (specifically the processGIF89A function and the underlying omggif.js GifReader), which reads width and height values directly from the GIF Logical Screen Descriptor header without any sanity checks before allocating a pixel buffer of size width * height. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). An attacker crafts a GIF with extreme dimensions (e.g., 65535×65535) — achievable by hex-editing offsets 0x06 and 0x08 to 0xFFFF — and passes it to addImage() or html(), causing the engine to attempt allocation of a multi-gigabyte pixel buffer. The fix in commit 2e5e156 adds a guard in both decodeAndBlitFrameBGRA and decodeAndBlitFrameRGBA that throws an error if num_pixels exceeds 512×1024×1024 (jsPDF Commit, ZeroXJacks PoC).

Successful exploitation results in out-of-memory (OOM) errors and denial of service, with no impact on confidentiality or integrity. On the client side (browser), the affected tab freezes or crashes, potentially causing loss of unsaved user data. On the server side (Node.js), a single malicious request can exhaust the process heap, crashing the PDF generation service entirely and causing a complete service outage. Downstream IBM products incorporating jsPDF — including IBM API Connect, IBM Cloud Pak for Business Automation, IBM Instana Observability, IBM InfoSphere Optim Archive Viewer, and Cloudera Data Platform with IBM — are also affected (GitHub Advisory, IBM Advisory).

A public proof-of-concept write-up is available from the reporter (ZeroXJacks), detailing the exact hex-editing technique and exploit code needed to craft a malicious GIF (ZeroXJacks PoC). No authentication or user interaction is required, and attack complexity is low, making this straightforward to exploit against any application that passes user-controlled image data to jsPDF. There is no confirmed evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.042% (24th percentile), indicating a currently low probability of exploitation in the next 30 days. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft the malicious GIF: Take a minimal valid GIF file and hex-edit the Logical Screen Descriptor width field (offset 0x06) and height field (offset 0x08) to 0xFF 0xFF (65535), creating a GIF that claims dimensions of 65535×65535 pixels.
2. Identify a target: Find a web application or Node.js service that uses jsPDF < 4.2.0 and accepts user-supplied image data or URLs passed to addImage() or html() without sanitization.
3. Deliver the payload: Submit the crafted GIF as image input to the vulnerable endpoint — for example, via a file upload form, an API parameter, or a URL reference that the server-side jsPDF instance will fetch and process.
4. Trigger memory exhaustion: When jsPDF processes the GIF, processGIF89A reads the inflated dimensions and calls decodeAndBlitFrameRGBA, which attempts to allocate a Uint8Array of ~4×65535×65535 bytes (~17 GB), causing a RangeError: Invalid array length or OOM crash.
5. Achieve denial of service: The Node.js process crashes (server-side) or the browser tab freezes/crashes (client-side), rendering the PDF generation service unavailable (ZeroXJacks PoC, GitHub Advisory).

• Logs: Application error logs showing RangeError: Invalid array length or JavaScript heap out of memory errors originating from jsPDF's GIF processing code (gif_support.js, omggif.js, or decodeAndBlitFrameRGBA).
• Logs: Node.js process crash logs or OOM killer entries (e.g., Linux dmesg showing Out of memory: Kill process for the Node.js service).
• Network: Repeated HTTP requests submitting GIF files or GIF URLs to PDF generation endpoints, particularly from the same source IP in a short time window.
• File System: Presence of GIF files with anomalously small file sizes but extremely large reported dimensions (e.g., a file under 1 KB claiming 65535×65535 resolution) in upload directories or temporary storage.
• Process: Sudden spikes in memory consumption by the Node.js process immediately preceding a crash, visible in system monitoring tools (e.g., top, htop, or APM dashboards).

The primary remediation is to upgrade jsPDF to version 4.2.0 or later, which adds a pixel-count guard (rejecting images where width × height > 512 × 1024 × 1024) in the GIF decoder (jsPDF Commit, GitHub Advisory). As a workaround where immediate patching is not possible, sanitize all image data or URLs before passing them to addImage(), html(), or other affected methods — specifically, validate and reject GIF files with width or height values exceeding a reasonable maximum (e.g., 10,000 pixels per dimension). IBM has released product-specific advisories and patches for affected products including IBM API Connect, IBM Cloud Pak for Business Automation, IBM Instana Observability, and IBM InfoSphere Optim Archive Viewer (IBM Advisory).

Red Hat opened a tracking bug (Bugzilla #2440992) for the vulnerability shortly after disclosure, classifying it as high severity (Red Hat Bugzilla). IBM issued multiple security bulletins across its product portfolio acknowledging the impact on IBM API Connect, Cloud Pak for Business Automation, Instana Observability, InfoSphere Optim Archive Viewer, and Cloudera Data Platform with IBM, and released corresponding fixes (IBM Advisory). No significant broader community debate or media coverage has been identified beyond standard vulnerability database entries and vendor advisories.