jsPDF has a Shared State Race Condition in addJS Plugin

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-24040 · CVE overview and exploitation status

EUVD-2026-5292

GHSA-cjw8-79x6-5cj4

cve-program · CVE-2026-24040

• https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4
• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

euvd · EUVD-2026-5292

• https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4
• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

nvd · CVE-2026-24040

• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0
• https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4

osv · GHSA-cjw8-79x6-5cj4

• https://github.com/parallax/jsPDF/security/advisories/GHSA-cjw8-79x6-5cj4
• https://nvd.nist.gov/vuln/detail/CVE-2026-24040
• https://github.com/parallax/jsPDF/commit/2863e5c26afef211a545e8c174ab4d5fce3b8c0e
• https://github.com/parallax/jsPDF
• https://github.com/parallax/jsPDF/releases/tag/v4.1.0

• jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.… · Advisory content revised · 15 Nov 2026