unstale

npm / jspdf

jspdf

What changed in jspdf 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.

11 security1 new APIs and options

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

jspdf 412 changes

Security 11

  • jsPDF has a PDF Object Injection via FreeText color

    4.2.1security advisory

  • jsPDF has HTML Injection in New Window paths

    4.2.1security advisory

  • jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

    4.2.0security advisory

  • jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

    4.2.0security advisory

  • jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

    4.2.0security advisory

  • Fixes PDF injection that allowed arbitrary JavaScript execution in the AcroForm module.

    4.1.0release notes

  • jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

    4.1.0security advisory

  • jsPDF has Shared State Race Condition in addJS Plugin

    4.1.0security advisoryrelease notes

  • jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

    4.1.0security advisoryrelease notes

  • jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

    4.1.0security advisoryrelease notes

  • jsPDF has Local File Inclusion/Path Traversal vulnerability

    4.0.0security advisory

New APIs and options 1

  • Adds a default property to the package.json export section.

    4.2.0release notes