CVE-2025-68428
A flaw in the jsPDF library lets attackers read any file on the server when using the node.js build. By passing a crafted path to the loadFile method, malicious code can include the contents of that file in a PDF. The issue is fixed in version 4.0.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
jsPDF library, node.js builds (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0. Typical users are developers using jsPDF in Node.js applications.
Real-world impact
An attacker could read sensitive files on the server and embed them into PDFs, potentially exposing confidential data or facilitating further attacks.
Why this severity
The CVSS score of 9.2 reflects the high impact of the vulnerability: it allows attackers to read any file on the system (high confidentiality impact) without authentication or user interaction, making it a critical flaw.
What to do about it
- 01Upgrade jsPDF to version 4.0.0 or later.
- 02Restart the Node.js application to apply the update.
NVD-referenced vendor advisory
Timeline
- Jan 5, 2026 · Jan 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 16d agoAdvisory updatedThe NVD record was last revised.
- Jul 20, 2026 · 16d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/parallax/jsPDF/commit/a688c…patch
- github.com/parallax/jsPDF/releases/tag…productrelease notes
- github.com/parallax/jsPDF/security/adv…third party advisory
- access.redhat.com/errata/RHSA-2026:1517
- access.redhat.com/errata/RHSA-2026:2350
- access.redhat.com/errata/RHSA-2026:2568
- access.redhat.com/security/cve/CVE-2025-68428
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2…