In January 2026, a critical security vulnerability was disclosed in jsPDF, a popular JavaScript library used to generate PDF documents. The issue, tracked as CVE-2025-68428, affects server-side Node.js deployments of jsPDF prior to version 4.0.0 and has been assigned a CVSS score of 9.2.
The vulnerability is a path traversal issue that can be abused to read arbitrary files from the local filesystem. If untrusted input is allowed to influence which resources jsPDF loads during PDF generation, an attacker may be able to retrieve sensitive files from the server and have their contents embedded directly into the generated PDF response.
jsPDF vulnerability technical details
jsPDF is widely used to dynamically generate reports, invoices, and documents in web applications. While it is often associated with client-side browser usage, jsPDF also provides a Node.js build that allows applications to generate PDFs on the server. It is this server-side usage that introduces risk, as it runs with direct access to the underlying filesystem.
When used in a Node.js environment, jsPDF supports loading local resources from disk so they can be embedded into generated documents, including images, custom fonts, and HTML content. This functionality relies on an internal file-loading mechanism that reads files directly from the filesystem when a path is provided. The vulnerability originates in this behaviour, specifically in the `loadFile()` method within jsPDF’s Node.js builds. If an attacker can control the first argument passed into this method, they can supply traversal sequences (‘../’) that cause jsPDF to read files outside the intended directory scope and embed their contents into the generated PDF output.
Several public jsPDF methods rely on this same underlying file-loading behaviour. Features such as `addImage()`, `html()`, and `addFont()` route through the same internal mechanism when handling file-based input. As a result, applications may be exposed even if they never call `loadFile()` directly.
This behaviour only manifests when jsPDF is used server-side in a Node.js context, where the library is able to interact directly with the local filesystem. In browser environments, jsPDF executes within the usual client-side sandbox and does not have access to local files, meaning this issue does not arise. As a result, the risk is confined to backend PDF generation workflows rather than client-side document rendering.
Impact summary of CVE-2025-68428
Successful exploitation of CVE-2025-68428 allows an attacker to read arbitrary files accessible to the Node.js process running the affected application. This can expose configuration files, credentials, private keys, logs, and application source code, depending on the permissions under which the service operates.
In practice, sensitive files may be embedded directly into a generated PDF and exfiltrated as part of a document download. While the vulnerability does not enable code execution, the disclosure of secrets and internal configuration data may be sufficient to enable further compromise, and organisations should treat affected deployments as high risk.
Mitigating the vulnerability
The vulnerability has been addressed in jsPDF version 4.0.0. Upgrading to this version or later is the primary remediation step and should be prioritised for any application using jsPDF server-side.
It is important to note that the fix relies on Node.js permission mode, which restricts filesystem access unless explicitly allowed at runtime. Permission mode was introduced in Node.js 20 and is considered stable in later releases. Organisations should ensure they are running a compatible Node.js version before relying on this mitigation and refer to the Node.js documentation for guidance on enabling and scoping filesystem permissions correctly.
Lastly, organisations should be cautious not to rely on the library upgrade alone. If filesystem read access is scoped too broadly in order to preserve existing functionality, the protection provided by the fix can be undermined. While Node.js permission mode provides the strongest protection, strict validation and allowlisting of file paths should be enforced, particularly where permission mode cannot be enabled or scoped appropriately.
How can Sentrium help?
Sentrium offer vulnerability assessment and penetration testing services that can help you identify vulnerable server-side PDF generation deployments and third-party library risks across your environments. Our skilled team can validate whether existing security controls are effective in practice and provide practical recommendations to reduce the risk of sensitive data exposure. Start your assessment today by completing our pentest scoping form or get in touch with our team to find out more about our penetration testing services.
