CVE-2026-24040

jsPDF has a Shared State Race Condition in addJS Plugin

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User Data Leakage, where the PDF generated for User A contains the JavaScript payload (and any embedded sensitive data) intended for User B. Typically, this only affects server-side environments, although the same race conditions might occur if jsPDF runs client-side. The vulnerability has been fixed in [email protected].

We have discovered 6,845 live websites that are affected by CVE-2026-24040.

Run a Free Instant Scan



Affected Software

Product  jspdf
Category JavaScript Libraries
Vulnerable Domains6,845 live websites (100% of jspdf install base)
Vulnerable Versions
  • from 0 through 4.1
Vulnerable Versions Count28 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - Feb 2, 2026
  • Updated - Feb 3, 2026

Website Distribution by Country

Number of websites using CVE-2026-24040
United States2,939 websites


Germany364 websites
Brazil316 websites
France280 websites
India269 websites
GB211 websites
Russia162 websites
Italy158 websites
Canada144 websites
Netherlands136 websites

Website Distribution by TLD

Number of websites using CVE-2026-24040
.com3,000 websites
.org454 websites
.net210 websites
.com.br203 websites
.de193 websites
.ru142 websites
.fr129 websites
.it128 websites
.nl111 websites
.co.uk110 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-24040

Top websites that are affected by CVE-2026-24040. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.ru Russia**,***
*************************.***.es Spain**,***
*******.com United States**,***
********.gov United States**,***
**************.at Austria**,***
******.******.com China**,***
************.com United States**,***
********************.us United States**,***
******.by Belarus**,***
***********.org United States**,***
See full domain list

FAQ

CVE-2026-24040 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in jspdf
A total of 6,845 websites have been identified as vulnerable to CVE-2026-24040, based on global website indexing conducted by WebTechSurvey.
The jspdf is affected by the CVE-2026-24040 vulnerability.
jspdf versions up to 4.1 are vulnerable to CVE-2026-24040.
CVE-2026-24040 is resolved in version 4.1 of jspdf.