Skip to main content
cve.nowby Sazabi
← npm
npmPackage

dompurify

32 known vulnerabilities (2 critical, 2 high, 25 medium), with the versions each affects and the releases that fix them.

Latest release
3.4.17 (Oct 12, 2026): no advisory affects it
Newest unaffected release
3.4.17 (Oct 12, 2026), the latest release
Advisories
32 · 2 critical, 2 high, 25 medium
Weekly downloads
95.8M
Dependents
16.9K
Releases
154 since 0.4.0 (May 21, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 32 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 32

  • CVE-2026-116804Medium 5.1

    DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

    Affected: from 3.4.4, fixed in 3.4.17.

    Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure).

    The latest release, 3.4.17, is not affected.

    32% of dompurify downloads last week were affected versions (33.3M).

  • CVE-2026-116803Medium 5.1

    DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

    Affected: fixed in 3.4.17.

    Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure).

    The latest release, 3.4.17, is not affected.

    58% of dompurify downloads last week were affected versions (60.7M).

  • CVE-2026-116802Medium 5.1

    DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

    Affected: fixed in 3.4.17.

    Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure).

    The latest release, 3.4.17, is not affected.

    58% of dompurify downloads last week were affected versions (60.7M).

  • CVE-2026-109345Medium 5.1

    DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

    Affected: fixed in 3.4.16.

    Fixed in 3.4.16 (released Sep 23, 2026, 19 days before disclosure).

    The latest release, 3.4.17, is not affected.

    51% of dompurify downloads last week were affected versions (53.2M).

  • CVE-2026-109344Medium 5.1

    DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

    Affected: from 3.4.13, fixed in 3.4.16.

    Fixed in 3.4.16 (released Sep 23, 2026, 19 days before disclosure).

    The latest release, 3.4.17, is not affected.

    12% of dompurify downloads last week were affected versions (12.8M).

  • CVE-2026-75838Medium 5.1

    DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

    Affected: fixed in 3.4.13.

    Fixed in 3.4.13 (released Aug 3, 2026, 15 days before disclosure).

    The latest release, 3.4.17, is not affected.

    39% of dompurify downloads last week were affected versions (40.4M).

  • CVE-2026-66010Medium 5.1

    DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

    Affected: fixed in 3.4.12.

    Fixed in 3.4.12 (released Jul 11, 2026, 13 days before disclosure).

    The latest release, 3.4.17, is not affected.

    34% of dompurify downloads last week were affected versions (35.8M).

  • CVE-2026-65914Medium 5.3

    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    Affected: fixed in 3.3.2.

    Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure).

    The latest release, 3.4.17, is not affected.

    19% of dompurify downloads last week were affected versions (20.3M).

  • CVE-2026-65913Medium 5.1

    DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    Affected: fixed in 3.3.2.

    Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure).

    The latest release, 3.4.17, is not affected.

    19% of dompurify downloads last week were affected versions (20.3M).

  • CVE-2026-65912Medium 5.1

    DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

    Affected: fixed in 3.3.2.

    Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure).

    The latest release, 3.4.17, is not affected.

    19% of dompurify downloads last week were affected versions (20.3M).

  • CVE-2026-65903Medium 5.1

    DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

    Affected: fixed in 3.4.0.

    Fixed in 3.4.0 (released Apr 14, 2026, 100 days before disclosure).

    The latest release, 3.4.17, is not affected.

    23% of dompurify downloads last week were affected versions (23.8M).

  • CVE-2026-65902Medium 5.3

    DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    Affected: fixed in 3.4.7.

    Fixed in 3.4.7 (released May 27, 2026, 57 days before disclosure).

    The latest release, 3.4.17, is not affected.

    27% of dompurify downloads last week were affected versions (28.7M).

  • CVE-2026-65901Medium 5.1

    DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

    Affected: through 3.4.6.

    Fixed in 3.4.7 (released May 27, 2026, 57 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.4.17, is not affected.

    27% of dompurify downloads last week were affected versions (28.7M).

  • CVE-2026-65900Medium 5.1

    DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

    Affected: from 3.0.0, fixed in 3.4.8.

    Fixed in 3.4.8 (released Jun 3, 2026, 50 days before disclosure).

    The latest release, 3.4.17, is not affected.

    24% of dompurify downloads last week were affected versions (25.2M).

  • CVE-2026-65899Medium 5.1

    DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    Affected: fixed in 3.4.9.

    Fixed in 3.4.9 (released Jun 10, 2026, 43 days before disclosure).

    The latest release, 3.4.17, is not affected.

    29% of dompurify downloads last week were affected versions (30.8M).

Show all 32 advisoriesShow fewer advisories
  • CVE-2026-65898Medium 5.1

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    Affected: fixed in 3.4.11.

    Fixed in 3.4.11 (released Jun 17, 2026, 36 days before disclosure).

    The latest release, 3.4.17, is not affected.

    30% of dompurify downloads last week were affected versions (31.7M).

  • CVE-2026-49978Medium 6.3

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    Affected: fixed in 3.4.7.

    Fixed in 3.4.7 (released May 27, 2026, 48 days before disclosure).

    The latest release, 3.4.17, is not affected.

    27% of dompurify downloads last week were affected versions (28.7M).

  • CVE-2026-49459Medium 6.1

    DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

    Affected: fixed in 3.4.6.

    Fixed in 3.4.6 (released May 26, 2026, 49 days before disclosure).

    The latest release, 3.4.17, is not affected.

    27% of dompurify downloads last week were affected versions (28.5M).

  • CVE-2026-49458Medium 6.1

    DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

    Affected: fixed in 3.4.6.

    Fixed in 3.4.6 (released May 26, 2026, 49 days before disclosure).

    The latest release, 3.4.17, is not affected.

    27% of dompurify downloads last week were affected versions (28.5M).

  • DOMPurify XSS via `selectedcontent` re-clone

    Affected: from 3.4.4, fixed in 3.4.5.

    Fixed in 3.4.5 (released May 18, 2026, 57 days before disclosure).

    The latest release, 3.4.17, is not affected.

    <0.1% of dompurify downloads last week were affected versions (75.2K).

  • CVE-2026-41240Medium 6.0

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    Affected: fixed in 3.4.0.

    Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure).

    The latest release, 3.4.17, is not affected.

    23% of dompurify downloads last week were affected versions (23.8M).

  • CVE-2026-41239Medium 6.8

    DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

    Affected: from 1.0.10, fixed in 3.4.0.

    Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure).

    The latest release, 3.4.17, is not affected.

    23% of dompurify downloads last week were affected versions (23.8M).

  • CVE-2026-41238Medium 6.9

    DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

    Affected: from 3.0.1, fixed in 3.4.0.

    Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure).

    The latest release, 3.4.17, is not affected.

    19% of dompurify downloads last week were affected versions (19.6M).

  • CVE-2026-0540Medium 5.3

    DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

    Affected: from 3.1.3, fixed in 3.3.2; from 2.5.3, fixed in 2.5.9.

    Fixed in 2.5.9 (released Mar 5, 2026, 2 days after disclosure) and 3.3.2 (released Mar 5, 2026, 2 days after disclosure).

    The latest release, 3.4.17, is not affected.

    17% of dompurify downloads last week were affected versions (17.5M).

  • CVE-2025-15599Medium 5.1

    DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

    Affected: from 3.1.3, fixed in 3.2.7; from 2.5.3, through 2.5.8.

    Fixed in 3.2.7 (released Sep 17, 2025, 167 days before disclosure).

    The latest release, 3.4.17, is not affected.

    6.8% of dompurify downloads last week were affected versions (7.1M).

  • CVE-2025-26791Medium 4.5

    DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

    Affected: fixed in 3.2.4.

    Fixed in 3.2.4 (released Jan 30, 2025, 15 days before disclosure).

    The latest release, 3.4.17, is not affected.

    5.9% of dompurify downloads last week were affected versions (6.1M).

  • CVE-2024-48910Critical 9.1

    DOMPurify vulnerable to tampering by prototype polution

    Affected: fixed in 2.4.2.

    Fixed in 2.4.2 (released Jan 5, 2023, 665 days before disclosure).

    The latest release, 3.4.17, is not affected.

    0.5% of dompurify downloads last week were affected versions (544.9K).

  • CVE-2024-47875Critical 10.0

    DOMPurify nesting-based mXSS

    Affected: fixed in 2.5.0; from 3.0.0, fixed in 3.1.3.

    Fixed in 2.5.0 (released Apr 7, 2024, 187 days before disclosure) and 3.1.3 (released May 11, 2024, 153 days before disclosure).

    The latest release, 3.4.17, is not affected.

    1.2% of dompurify downloads last week were affected versions (1.3M).

  • Tampering by prototype polution in DOMPurify

    Affected: fixed in 2.5.4; from 3.0.0, fixed in 3.1.3.

    Fixed in 2.5.4 (released May 20, 2024, 119 days before disclosure) and 3.1.3 (released May 11, 2024, 128 days before disclosure).

    The latest release, 3.4.17, is not affected.

    1.2% of dompurify downloads last week were affected versions (1.3M).

  • DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"'…

    Affected: fixed in 1.0.11.

    Fixed in 1.0.11 (released Jun 18, 2019, 1596 days before disclosure).

    The latest release, 3.4.17, is not affected.

    <0.1% of dompurify downloads last week were affected versions (14.9K).

  • Cure53 DOMPurify before 2.0.17 allows mutation XSS.

    Affected: fixed in 2.0.17.

    Fixed in 2.0.17 (released Sep 20, 2020, 17 days before disclosure).

    The latest release, 3.4.17, is not affected.

    <0.1% of dompurify downloads last week were affected versions (76.7K).

  • DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome…

    Affected: fixed in 2.0.3.

    Fixed in 2.0.3 (released Sep 25, 2019, 1 day after disclosure).

    The latest release, 3.4.17, is not affected.

    <0.1% of dompurify downloads last week were affected versions (45.7K).