CVE-2026-24040

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in jsPDF@4.1.0.

• CWE-362

• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0ePatch
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0Release Notes
• https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4Exploit, Vendor Advisory

Published

Feb 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24035Horilla is a free and open source Human Resource Management …4.3
• CVE-2026-24036Horilla is a free and open source Human Resource Management …5.3
• CVE-2026-24037Horilla is a free and open source Human Resource Management …5.4
• CVE-2026-24038Horilla is a free and open source Human Resource Management …8.1
• CVE-2026-24039Horilla is a free and open source Human Resource Management …4.3
• CVE-2026-2404CWE-116 Improper Encoding or Escaping of Output vulnerabilit…5.3
• CVE-2026-24042Appsmith is a platform to build admin panels, internal tools…9.8
• CVE-2026-24043jsPDF is a library to generate PDFs in JavaScript. Prior to …5.4
• CVE-2026-24044Element Server Suite Community Edition (ESS Community) deplo…9.2
• CVE-2026-24045Docmost is open-source collaborative wiki and documentation …5.4
• CVE-2026-24046Backstage is an open framework for building developer portal…7.1
• CVE-2026-24047Backstage is an open framework for building developer portal…6.3