CVE-2026-25630: survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
The following security vulnerability was identified in jsPDF versions = 4.0.0 and included the fix in the following survey-pdf releases: v1.12.59 v2.5.5 Action Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately. Notes No other survey-pdf dependencies are affected. This update is fully backward-compatible with previous survey-pdf releases.
Published Feb 4, 2026 · Updated Feb 5, 2026
Affected packages
survey-pdf
- Ecosystem
- npm
- Affected
- <= 1.12.58
- Fixed in
- 1.12.59
- Check
npm ls survey-pdf
survey-pdf
- Ecosystem
- npm
- Affected
- >= 2.0.0, <= 2.5.4
- Fixed in
- 2.5.5
- Check
npm ls survey-pdf
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.
Impact
Since SurveyJS PDF Generator depends on jsPDF, any project using survey-pdf v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability.
Solution
SurveyJS PDF Generator has upgraded jsPDF to version >= 4.0.0 and included the fix in the following survey-pdf releases:
Action
Users should upgrade survey-pdf in their projects to v1.12.59+ or v2.5.5+ immediately.
Notes
No other survey-pdf dependencies are affected. This update is fully backward-compatible with previous survey-pdf releases.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology