CVE-2026-25630: Survey pdf Survey-pdf Upgraded JsPDF Version Due Vulnerability

CRITICAL
Advisory Identifier: GHSA-h3q6-jfrg-3x6q
Share
CWE-35 CWE-73
Published
Advisory Summary

CVE-2026-25630 is a CRITICAL survey-pdf upgraded jspdf version due vulnerability (CWE-35: Path Traversal: '.../...//') affecting Survey pdf libraries in the npm ecosystem. The issue involves survey-pdf upgraded jspdf version due to security vulnerability. Remediation is available by upgrading affected packages to version 1.12.59, 2.5.5.

CVE-2026-25630 at a Glance

CVE Identifier CVE-2026-25630
GHSA Identifier GHSA-h3q6-jfrg-3x6q
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-35: Path Traversal: '.../...//'
Affected Product Survey pdf
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-25630

To remediate this vulnerability, upgrade all affected Survey pdf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

survey-pdf fixed: 1.12.59 
npm install survey-pdf@1.12.59
survey-pdf fixed: 2.5.5 
npm install survey-pdf@2.5.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls survey-pdf

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-25630, inspect your project dependencies using npm:

npm ls survey-pdf

Analyze the terminal output to locate any version of Survey pdf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.12.59), your application is affected.

Note: The npm ls survey-pdf command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-35: Path Traversal: '.../...//', where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. In Survey pdf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The following security vulnerability was identified in jsPDF versions <=3.0.4: [Local File Inclusion/Path Traversal](https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2). ### Impact Since SurveyJS PDF Generator depends on jsPDF, any project using `survey-pdf` v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability. ### Solution SurveyJS PDF Generator has upgraded jsPDF to version >= 4.0.0 and included the fix in the following `survey-pdf` releases: * [v1.12.59](https://www.npmjs.com/package/survey-pdf/v/1.12.59) * [v2.5.5](https://www.npmjs.com/package/survey-pdf/v/2.5.5) ### Action Users should upgrade `survey-pdf` in their projects to v1.12.59+ or v2.5.5+ immediately. ### Notes No other `survey-pdf` dependencies are affected. This update is fully backward-compatible with previous `survey-pdf` releases.

CVE-2026-25630 Affected Survey pdf Versions

2 component(s)
Fixed Versions:
1.12.592.5.5
Product / Package Ecosystem Affected Versions Fixed Version
survey-pdf
npm/survey-pdf
npm
< 1.12.59
1.12.59
survey-pdf
npm/survey-pdf
npm
≥ 2.0.0
< 2.5.5
2.5.5

References

GitHub Advisory / Wiki ADVISORY
https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2
GitHub Advisory / Wiki ADVISORY
https://github.com/surveyjs/survey-pdf/security/advisories/GHSA-h3q6-jfrg-3x6q
NVD — CVE-2026-25630 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25630
Survey pdf Source Repository REPOSITORY
https://github.com/surveyjs/survey-pdf

Frequently Asked Questions

What is CVE-2026-25630?
CVE-2026-25630 is a security vulnerability in Survey pdf involving survey-pdf Upgraded jsPDF Version Due to Security Vulnerability under CWE-35: Path Traversal: '.../...//'.
Which Survey pdf versions are affected?
Affected versions include releases prior to 1.12.59, 2.5.5 across affected packages: survey-pdf.
What version fixes CVE-2026-25630?
Upgrading to 1.12.59, 2.5.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is survey-pdf affected?
Yes, survey-pdf is affected in releases prior to 1.12.59, 2.5.5. Upgrade your dependency to 1.12.59, 2.5.5 or later.
What CWE is associated with CVE-2026-25630?
CVE-2026-25630 is classified under CWE-35: Path Traversal: '.../...//' (The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.).
How can I check npm dependencies for CVE-2026-25630?
Run the dependency tree command: 'npm ls survey-pdf'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h3q6-jfrg-3x6q",
  "modified" : "2026-02-05T21:47:25Z",
  "published" : "2026-02-04T20:07:34Z",
  "aliases" : [ "CVE-2026-25630" ],
  "summary" : "survey-pdf Upgraded jsPDF Version Due to Security Vulnerability",
  "details" : "The following security vulnerability was identified in jsPDF versions <=3.0.4: [Local File Inclusion/Path Traversal](https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2).\n\n### Impact\n\nSince SurveyJS PDF Generator depends on jsPDF, any project using `survey-pdf` v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability.\n\n### Solution\n\nSurveyJS PDF Generator has upgraded jsPDF to version >= 4.0.0 and included the fix in the following `survey-pdf` releases:\n\n* [v1.12.59](https://www.npmjs.com/package/survey-pdf/v/1.12.59)\n* [v2.5.5](https://www.npmjs.com/package/survey-pdf/v/2.5.5)\n\n### Action\n\nUsers should upgrade `survey-pdf` in their projects to v1.12.59+ or v2.5.5+ immediately.\n\n### Notes\n\nNo other `survey-pdf` dependencies are affected. This update is fully backward-compatible with previous `survey-pdf` releases.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "survey-pdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.12.59"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.12.58"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "survey-pdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0"
      }, {
        "fixed" : "2.5.5"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.5.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/surveyjs/survey-pdf/security/advisories/GHSA-h3q6-jfrg-3x6q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25630"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/surveyjs/survey-pdf"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-35", "CWE-73" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-04T20:07:34Z",
    "nvd_published_at" : "2026-02-05T19:15:56Z"
  }
}