jspdf

library1.0jsnpmunverified

jsPDF is a client-side JavaScript library for generating PDF documents. The current stable version is 4.2.1, with frequent patch and minor releases primarily addressing security vulnerabilities and bug fixes, indicating an active maintenance and development cadence. It enables developers to create PDFs directly in the browser or Node.js environment, supporting various paper sizes, orientations, and units (e.g., millimeters, inches). Key differentiators include its pure JavaScript nature, allowing it to run without server-side dependencies, and its robust API for adding text, images, and other content. It bundles different module formats (ESM, UMD, Node) to support diverse environments, often requiring no explicit path specification in imports as build tools handle it. The project has recently focused heavily on fixing various security-related issues, emphasizing the importance of sanitizing all user input.

serialization

npm install jspdf

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · JSPDF

jspdf

serializationjavascriptv1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

jsPDF

✓ import { jsPDF } from 'jspdf';

✗ import jspdf from 'jspdf'; import { default as jsPDF } from 'jspdf';

jsPDF is exported as a named export. Default imports are incorrect.

jsPDF

✓ const { jsPDF } = require('jspdf');

✗ const jsPDF = require('jspdf');

When using CommonJS in Node.js, `jsPDF` is a named property of the module export.

jsPDF

✓ const { jsPDF } = window.jspdf;

✗ const jsPDF = window.jspdf;

For browser script-tag usage, the library populates a global `window.jspdf` object, which contains `jsPDF` as a named property.

This quickstart code demonstrates how to initialize a jsPDF document, add basic text and shapes, and save the resulting PDF file. It uses the default A4 portrait format and millimeters for units, then outputs 'my-first-document.pdf'.

import { jsPDF } from 'jspdf'; // Create a new PDF document with default settings (A4, portrait, millimeters) const doc = new jsPDF(); // Add text to the document doc.text('Hello, jsPDF World!', 10, 10); // 'Hello, jsPDF World!' at x=10mm, y=10mm // Add another line of text with a different font size doc.setFontSize(16); doc.text('This is a test document generated by jsPDF.', 10, 20); // Add a rectangle (x, y, width, height, style) doc.rect(10, 30, 50, 20, 'S'); // 'S' for stroke // Save the document, triggering a download in browsers or writing to file in Node.js doc.save('my-first-document.pdf'); console.log('PDF document generated and saved!');

Debug

Known issues

breakingjsPDF v3.0.0 officially dropped support for Internet Explorer. Code relying on IE-specific features or older JavaScript environments may break.

fix

Ensure your target browser environment is modern (not IE) or use appropriate polyfills if compatibility with very old browsers is essential, though not officially supported.

affects: >=3.0.0

breakingIn Node.js builds, v4.0.0 introduced a critical path traversal/local file inclusion fix. File system access is now restricted by default. Attempts to read local files via paths outside explicit allowances will fail.

fix

To enable file system access, use Node.js's `--permission` flag or set `jsPDF.allowFsRead` property to `true`. Exercise caution and validate all file paths if enabling this feature: `const doc = new jsPDF(); doc.allowFsRead = true;`

affects: >=4.0.0

gotchajsPDF has had numerous security vulnerabilities related to PDF Object Injection, HTML Injection, JavaScript Execution, and Denial of Service (DoS) in various modules (AcroForm, addImage, addJS, output methods) across versions 3.0.1, 3.0.2, 4.1.0, 4.2.0, and 4.2.1.

fix

Always use the latest stable version of jsPDF. Critically, **sanitize all user-provided input** before passing it to any jsPDF method, especially `text`, `html`, `addImage`, `addSvgAsImage`, and form-related functions. Consider using DOMPurify explicitly if you are handling untrusted HTML input.

affects: >=3.0.1

gotchaStarting with v3.0.0, the `html` function relies on an updated `dompurify` dependency (v3.2.4+). Older versions of `dompurify` (or not having it installed) may leave `html` function susceptible to XSS vulnerabilities. Later versions (v4.1.0 and v4.2.x) also explicitly upgrade `dompurify` due to further vulnerabilities.

fix

Ensure `dompurify` is installed as a dependency and that you are using a recent version of jsPDF (v4.2.1 or newer is recommended) to benefit from the latest security patches for HTML rendering.

affects: >=3.0.0

Errors

Common errors & fixes

TypeError: jsPDF is not a constructor

Attempting to instantiate `jsPDF` using a default import or incorrect CommonJS `require` statement, when it is exported as a named export.

fix

Use named import: `import { jsPDF } from 'jspdf';` for ESM or `const { jsPDF } = require('jspdf');` for CommonJS.

Error: fs.readFileSync is not a function

This error can occur in browser environments if you are trying to use features of the Node.js specific build (e.g., saving to local file paths directly without browser download prompts) or if the build tool incorrectly bundles the Node.js version.

fix

Ensure your build system is configured to use the browser-compatible UMD or ES builds (e.g., `jspdf.umd.min.js` or `jspdf.es.min.js`). If in Node.js, ensure `jspdf` is resolving to its `jspdf.node.js` variant.

SecurityError: The operation is insecure.

When trying to save a PDF in a browser environment, this can happen if the browser's security policies (e.g., related to iframes or sandboxed environments) prevent file downloads or local storage operations.

fix

Ensure your application is served over HTTPS and not running in a highly restricted sandbox. Test in a standard browser environment. Some browser extensions might also interfere with file downloads.

UnhandledPromiseRejectionWarning: Error: Path traversal detected. Access to file system denied.

This warning/error occurs in Node.js environments with jsPDF v4.0.0+ when an operation attempts to access the file system without explicit permission, due to the new security restrictions.

fix

If you genuinely need file system access, set `jsPDF.allowFsRead = true;` after `const doc = new jsPDF();` or enable Node.js `--permission` flag. **Only do this if you fully trust the file paths being accessed.**

Upgrade

Version history

1.0latest on npm

Audit

Dependencies

dompurifyoptionalUsed internally by the `html` function for sanitizing HTML input to prevent XSS and other injection attacks. It is an optional dependency, but highly recommended for security.

Agent activity

37 hits · last 30 days

node

Resources

githubhttps://github.com/parallax/jsPDF ↗

packagehttps://www.npmjs.com/package/jspdf ↗

homepagehttps://parall.ax/products/jspdf ↗