# What changed in jspdf

> 12 changes in jspdf 4 from its official release notes, upgrade guides and advisories: 11 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-28. HTML: https://unstale.sh/npm/jspdf/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## jspdf 4

### Security

- jsPDF has a PDF Object Injection via FreeText color (4.2.1) — [security advisory](https://github.com/advisories/GHSA-7X6V-J9X4-QF24)
- jsPDF has HTML Injection in New Window paths (4.2.1) — [security advisory](https://github.com/advisories/GHSA-WFV2-PWC8-CRG5)
- jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions (4.2.0) — [security advisory](https://github.com/advisories/GHSA-67PG-WM7F-Q7FJ)
- jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) (4.2.0) — [security advisory](https://github.com/advisories/GHSA-P5XG-68WR-HM3M)
- jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method (4.2.0) — [security advisory](https://github.com/advisories/GHSA-9VJF-QC39-JPRP)
- Fixes PDF injection that allowed arbitrary JavaScript execution in the AcroForm module. (4.1.0) — [release notes](https://github.com/parallax/jsPDF/releases/tag/v4.1.0)
- jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution (4.1.0) — [security advisory](https://github.com/advisories/GHSA-PQXR-3G65-P328)
- jsPDF has Shared State Race Condition in addJS Plugin (4.1.0) — [security advisory](https://github.com/advisories/GHSA-CJW8-79X6-5CJ4), [release notes](https://github.com/parallax/jsPDF/releases/tag/v4.1.0)
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder (4.1.0) — [security advisory](https://github.com/advisories/GHSA-95FX-JJR5-F39C), [release notes](https://github.com/parallax/jsPDF/releases/tag/v4.1.0)
- jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) (4.1.0) — [security advisory](https://github.com/advisories/GHSA-VM32-VV63-W422), [release notes](https://github.com/parallax/jsPDF/releases/tag/v4.1.0)
- jsPDF has Local File Inclusion/Path Traversal vulnerability (4.0.0) — [security advisory](https://github.com/advisories/GHSA-F8CM-6447-X5H2)

### New APIs and options

- Adds a default property to the package.json export section. (4.2.0) — [release notes](https://github.com/parallax/jsPDF/releases/tag/v4.2.0)