CVE-2026-22787

npm/html2pdf.js CVE-2026-22787: high, EPSS 0.39%

html2pdf.js contains a cross-site scripting vulnerability

Action: Upgrade html2pdf.js to 0.14.0 or later.

npm i html2pdf.js@0.14.0

Affected

Fixed versions

Sources

• osv: GHSA-w8x4-x68c-m6fc
• https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc
• https://nvd.nist.gov/vuln/detail/CVE-2026-22787
• https://github.com/eKoopmans/html2pdf.js/issues/865
• https://github.com/eKoopmans/html2pdf.js/pull/877
• https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b
• https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability
• https://github.com/eKoopmans/html2pdf.js
• https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0

CVE-2026-22787 · published 2026-01-14T16:53:10Z · modified 2026-02-03T03:11:31.431997Z · JSON