CVE-2026-24040 jsPDF has a Shared State Race Condition in addJS Plugin
Concurrent requests in server-side environments may leak sensitive data between users due to shared state in the addJS plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24040?
CVE-2026-24040 is a medium-severity vulnerability in parallax jsPDF, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in [email protected].
Weakness: CWE-362
Which versions are affected by CVE-2026-24040?
2 open source packages ship an affected version, including jspdf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jspdf npm | All versions | 4.1.0 |
jspdf npm | All versions | 4.1.0 |
Products include Parall Jspdf.
How do I fix CVE-2026-24040?
Upgrade jspdf to 4.1.0 or later.
Is CVE-2026-24040 being exploited?
There is no known exploitation of CVE-2026-24040 in the wild and no public exploit code.
Other vulnerabilities in parallax jsPDF
- CVE-2026-31938 jsPDF has HTML Injection in New Window paths
- CVE-2025-68428 jsPDF has Local File Inclusion/Path Traversal vulnerability
- CVE-2026-25535 jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
- CVE-2026-24133 jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
- CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)
Sources
Also known as GHSA-cjw8-79x6-5cj4.