# dompurify (npm) vulnerabilities 32 known vulnerabilities (2 critical, 2 high, 25 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.4.17 (Oct 12, 2026): no advisory affects it - Newest unaffected release: 3.4.17 (Oct 12, 2026), the latest release - Weekly downloads: 95.8M - Dependents: 16.9K - Releases: 154 since 0.4.0 (May 21, 2014) - Registry: https://www.npmjs.com/package/dompurify - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116804: 3.4.4 to 3.4.16 (3.4.17 is outside it) - CVE-2026-116803: 0.4.0 to 3.4.16 (3.4.17 is outside it) - CVE-2026-116802: 0.4.0 to 3.4.16 (3.4.17 is outside it) - CVE-2026-109345: 0.4.0 to 3.4.15 (3.4.16 is outside it) - CVE-2026-109344: 3.4.13 to 3.4.15 (3.4.16 is outside it) - CVE-2026-75838: 0.4.0 to 3.4.12 (3.4.13 is outside it) - CVE-2026-66010: 0.4.0 to 3.4.11 (3.4.12 is outside it) - CVE-2026-65914: 0.4.0 to 3.3.1 (3.3.2 is outside it) - CVE-2026-65913: 0.4.0 to 3.3.1 (3.3.2 is outside it) - CVE-2026-65912: 0.4.0 to 3.3.1 (3.3.2 is outside it) - CVE-2026-65903: 0.4.0 to 3.3.3 (3.4.0 is outside it) - CVE-2026-65902: 0.4.0 to 3.4.6 (3.4.7 is outside it) - CVE-2026-65901: 0.4.0 to 3.4.6 (3.4.7 is outside it) - CVE-2026-65900: 3.0.0 to 3.4.7 (3.4.8 is outside it) - CVE-2026-65899: 0.4.0 to 3.4.8 (3.4.9 is outside it) - CVE-2026-65898: 0.4.0 to 3.4.10 (3.4.11 is outside it) - CVE-2026-49978: 0.4.0 to 3.4.6 (3.4.7 is outside it) - CVE-2026-49459: 0.4.0 to 3.4.5 (3.4.6 is outside it) - CVE-2026-49458: 0.4.0 to 3.4.5 (3.4.6 is outside it) - CVE-2026-47423: 3.4.4 (3.4.5 is outside it) - CVE-2026-41240: 0.4.0 to 3.3.3 (3.4.0 is outside it) - CVE-2026-41239: 1.0.10 to 3.3.3 (3.4.0 is outside it) - CVE-2026-41238: 3.0.1 to 3.3.3 (3.4.0 is outside it) - CVE-2026-0540: 2.5.3 to 2.5.8 (2.5.9 is outside it); 3.1.3 to 3.3.1 (3.3.2 is outside it) - CVE-2025-15599: 2.5.3 to 2.5.8 (2.5.9 is outside it); 3.1.3 to 3.2.6 (3.2.7 is outside it) - CVE-2025-26791: 0.4.0 to 3.2.3 (3.2.4 is outside it) - CVE-2024-48910: 0.4.0 to 2.4.1 (2.4.2 is outside it) - CVE-2024-47875: 0.4.0 to 2.4.9 (2.5.0 is outside it); 3.0.0 to 3.1.2 (3.1.3 is outside it) - CVE-2024-45801: 0.4.0 to 2.5.3 (2.5.4 is outside it); 3.0.0 to 3.1.2 (3.1.3 is outside it) - CVE-2019-25155: 0.4.0 to 1.0.10 (1.0.11 is outside it) - CVE-2020-26870: 0.4.0 to 2.0.16 (2.0.17 is outside it) - CVE-2019-16728: 0.4.0 to 2.0.2 (2.0.3 is outside it) ## Advisories (32) ### [CVE-2026-116804](https://cve.now/CVE-2026-116804): DOMPurify from 3.4.4 before 3.4.17 SAFE\_FOR\_TEMPLATES Bypass via Shadow Root Content - Severity: Medium 5.1 - Published: Oct 26, 2026 - Affected: from 3.4.4, fixed in 3.4.17. - Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure). - The latest release, 3.4.17, is not affected. - 32% of dompurify downloads last week were affected versions (33.3M). ### [CVE-2026-116803](https://cve.now/CVE-2026-116803): DOMPurify before 3.4.17 DOM XSS via IN\_PLACE Hook-Detached Subtrees - Severity: Medium 5.1 - Published: Oct 26, 2026 - Affected: fixed in 3.4.17. - Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure). - The latest release, 3.4.17, is not affected. - 58% of dompurify downloads last week were affected versions (60.7M). ### [CVE-2026-116802](https://cve.now/CVE-2026-116802): DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode - Severity: Medium 5.1 - Published: Oct 26, 2026 - Affected: fixed in 3.4.17. - Fixed in 3.4.17 (released Oct 12, 2026, 14 days before disclosure). - The latest release, 3.4.17, is not affected. - 58% of dompurify downloads last week were affected versions (60.7M). ### [CVE-2026-109345](https://cve.now/CVE-2026-109345): DOMPurify before 3.4.16 XSS via IN\_PLACE Returned Rawtext Root - Severity: Medium 5.1 - Published: Oct 12, 2026 - Affected: fixed in 3.4.16. - Fixed in 3.4.16 (released Sep 23, 2026, 19 days before disclosure). - The latest release, 3.4.17, is not affected. - 51% of dompurify downloads last week were affected versions (53.2M). ### [CVE-2026-109344](https://cve.now/CVE-2026-109344): DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN\_PLACE afterSanitize Hooks - Severity: Medium 5.1 - Published: Oct 12, 2026 - Affected: from 3.4.13, fixed in 3.4.16. - Fixed in 3.4.16 (released Sep 23, 2026, 19 days before disclosure). - The latest release, 3.4.17, is not affected. - 12% of dompurify downloads last week were affected versions (12.8M). ### [CVE-2026-75838](https://cve.now/CVE-2026-75838): DOMPurify before 3.4.13 Cross-Site Scripting via IN\_PLACE hook - Severity: Medium 5.1 - Published: Aug 18, 2026 - Affected: fixed in 3.4.13. - Fixed in 3.4.13 (released Aug 3, 2026, 15 days before disclosure). - The latest release, 3.4.17, is not affected. - 39% of dompurify downloads last week were affected versions (40.4M). ### [CVE-2026-66010](https://cve.now/CVE-2026-66010): DOMPurify before 3.4.12 Hook Bypass via CUSTOM\_ELEMENT\_HANDLING - Severity: Medium 5.1 - Published: Jul 24, 2026 - Affected: fixed in 3.4.12. - Fixed in 3.4.12 (released Jul 11, 2026, 13 days before disclosure). - The latest release, 3.4.17, is not affected. - 34% of dompurify downloads last week were affected versions (35.8M). ### [CVE-2026-65914](https://cve.now/CVE-2026-65914): DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization - Severity: Medium 5.3 - Published: Jul 23, 2026 - Affected: fixed in 3.3.2. - Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure). - The latest release, 3.4.17, is not affected. - 19% of dompurify downloads last week were affected versions (20.3M). ### [CVE-2026-65913](https://cve.now/CVE-2026-65913): DOMPurify before 3.3.2 Prototype Pollution via USE\_PROFILES - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: fixed in 3.3.2. - Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure). - The latest release, 3.4.17, is not affected. - 19% of dompurify downloads last week were affected versions (20.3M). ### [CVE-2026-65912](https://cve.now/CVE-2026-65912): DOMPurify before 3.3.2 URI Validation Bypass via ADD\_ATTR - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: fixed in 3.3.2. - Fixed in 3.3.2 (released Mar 5, 2026, 140 days before disclosure). - The latest release, 3.4.17, is not affected. - 19% of dompurify downloads last week were affected versions (20.3M). ### [CVE-2026-65903](https://cve.now/CVE-2026-65903): DOMPurify before 3.4.0 ADD\_TAGS Function Bypasses FORBID\_TAGS - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 14, 2026, 100 days before disclosure). - The latest release, 3.4.17, is not affected. - 23% of dompurify downloads last week were affected versions (23.8M). ### [CVE-2026-65902](https://cve.now/CVE-2026-65902): DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags - Severity: Medium 5.3 - Published: Jul 23, 2026 - Affected: fixed in 3.4.7. - Fixed in 3.4.7 (released May 27, 2026, 57 days before disclosure). - The latest release, 3.4.17, is not affected. - 27% of dompurify downloads last week were affected versions (28.7M). ### [CVE-2026-65901](https://cve.now/CVE-2026-65901): DOMPurify 3.4.6 Cross-Site Scripting via IN\_PLACE nodeName - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: through 3.4.6. - Fixed in 3.4.7 (released May 27, 2026, 57 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.4.17, is not affected. - 27% of dompurify downloads last week were affected versions (28.7M). ### [CVE-2026-65900](https://cve.now/CVE-2026-65900): DOMPurify before 3.4.8 Template Expression Injection via RETURN\_DOM - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: from 3.0.0, fixed in 3.4.8. - Fixed in 3.4.8 (released Jun 3, 2026, 50 days before disclosure). - The latest release, 3.4.17, is not affected. - 24% of dompurify downloads last week were affected versions (25.2M). ### [CVE-2026-65899](https://cve.now/CVE-2026-65899): DOMPurify before 3.4.9 Trusted Types Policy State Contamination - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: fixed in 3.4.9. - Fixed in 3.4.9 (released Jun 10, 2026, 43 days before disclosure). - The latest release, 3.4.17, is not affected. - 29% of dompurify downloads last week were affected versions (30.8M). ### [CVE-2026-65898](https://cve.now/CVE-2026-65898): DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig - Severity: Medium 5.1 - Published: Jul 23, 2026 - Affected: fixed in 3.4.11. - Fixed in 3.4.11 (released Jun 17, 2026, 36 days before disclosure). - The latest release, 3.4.17, is not affected. - 30% of dompurify downloads last week were affected versions (31.7M). ### [CVE-2026-49978](https://cve.now/CVE-2026-49978): DOMPurify IN\_PLACE Sanitization Bypass via Attached Shadow Root Inside \.content - Severity: Medium 6.3 - Published: Jul 14, 2026 - Affected: fixed in 3.4.7. - Fixed in 3.4.7 (released May 27, 2026, 48 days before disclosure). - The latest release, 3.4.17, is not affected. - 27% of dompurify downloads last week were affected versions (28.7M). ### [CVE-2026-49459](https://cve.now/CVE-2026-49459): DOMPurify: IN\_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM - Severity: Medium 6.1 - Published: Jul 14, 2026 - Affected: fixed in 3.4.6. - Fixed in 3.4.6 (released May 26, 2026, 49 days before disclosure). - The latest release, 3.4.17, is not affected. - 27% of dompurify downloads last week were affected versions (28.5M). ### [CVE-2026-49458](https://cve.now/CVE-2026-49458): DOMPurify: Cross-realm IN\_PLACE sanitization leaves executable markup intact via realm-bound \`instanceof\` checks - Severity: Medium 6.1 - Published: Jul 14, 2026 - Affected: fixed in 3.4.6. - Fixed in 3.4.6 (released May 26, 2026, 49 days before disclosure). - The latest release, 3.4.17, is not affected. - 27% of dompurify downloads last week were affected versions (28.5M). ### [CVE-2026-47423](https://cve.now/CVE-2026-47423): DOMPurify XSS via \`selectedcontent\` re-clone - Severity: High 8.2 - Published: Jul 14, 2026 - Affected: from 3.4.4, fixed in 3.4.5. - Fixed in 3.4.5 (released May 18, 2026, 57 days before disclosure). - The latest release, 3.4.17, is not affected. - <0.1% of dompurify downloads last week were affected versions (75.2K). ### [CVE-2026-41240](https://cve.now/CVE-2026-41240): DOMPurify: FORBID\_TAGS bypassed by function-based ADD\_TAGS predicate (asymmetry with FORBID\_ATTR fix) - Severity: Medium 6.0 - Published: Apr 23, 2026 - Affected: fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure). - The latest release, 3.4.17, is not affected. - 23% of dompurify downloads last week were affected versions (23.8M). ### [CVE-2026-41239](https://cve.now/CVE-2026-41239): DOMPurify has a SAFE\_FOR\_TEMPLATES bypass in RETURN\_DOM mode - Severity: Medium 6.8 - Published: Apr 23, 2026 - Affected: from 1.0.10, fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure). - The latest release, 3.4.17, is not affected. - 23% of dompurify downloads last week were affected versions (23.8M). ### [CVE-2026-41238](https://cve.now/CVE-2026-41238): DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM\_ELEMENT\_HANDLING Fallback - Severity: Medium 6.9 - Published: Apr 23, 2026 - Affected: from 3.0.1, fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 14, 2026, 9 days before disclosure). - The latest release, 3.4.17, is not affected. - 19% of dompurify downloads last week were affected versions (19.6M). ### [CVE-2026-0540](https://cve.now/CVE-2026-0540): DOMPurify XSS via Missing Rawtext Elements in SAFE\_FOR\_XML - Severity: Medium 5.3 - Published: Mar 3, 2026 - Affected: from 3.1.3, fixed in 3.3.2; from 2.5.3, fixed in 2.5.9. - Fixed in 2.5.9 (released Mar 5, 2026, 2 days after disclosure) and 3.3.2 (released Mar 5, 2026, 2 days after disclosure). - The latest release, 3.4.17, is not affected. - 17% of dompurify downloads last week were affected versions (17.5M). ### [CVE-2025-15599](https://cve.now/CVE-2025-15599): DOMPurify XSS via Textarea Rawtext Bypass in SAFE\_FOR\_XML - Severity: Medium 5.1 - Published: Mar 3, 2026 - Affected: from 3.1.3, fixed in 3.2.7; from 2.5.3, through 2.5.8. - Fixed in 3.2.7 (released Sep 17, 2025, 167 days before disclosure). - The latest release, 3.4.17, is not affected. - 6.8% of dompurify downloads last week were affected versions (7.1M). ### [CVE-2025-26791](https://cve.now/CVE-2025-26791): DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). - Severity: Medium 4.5 - Published: Feb 14, 2025 - Affected: fixed in 3.2.4. - Fixed in 3.2.4 (released Jan 30, 2025, 15 days before disclosure). - The latest release, 3.4.17, is not affected. - 5.9% of dompurify downloads last week were affected versions (6.1M). ### [CVE-2024-48910](https://cve.now/CVE-2024-48910): DOMPurify vulnerable to tampering by prototype polution - Severity: Critical 9.1 - Published: Oct 31, 2024 - Affected: fixed in 2.4.2. - Fixed in 2.4.2 (released Jan 5, 2023, 665 days before disclosure). - The latest release, 3.4.17, is not affected. - 0.5% of dompurify downloads last week were affected versions (544.9K). ### [CVE-2024-47875](https://cve.now/CVE-2024-47875): DOMPurify nesting-based mXSS - Severity: Critical 10.0 - Published: Oct 11, 2024 - Affected: fixed in 2.5.0; from 3.0.0, fixed in 3.1.3. - Fixed in 2.5.0 (released Apr 7, 2024, 187 days before disclosure) and 3.1.3 (released May 11, 2024, 153 days before disclosure). - The latest release, 3.4.17, is not affected. - 1.2% of dompurify downloads last week were affected versions (1.3M). ### [CVE-2024-45801](https://cve.now/CVE-2024-45801): Tampering by prototype polution in DOMPurify - Severity: High 7.3 - Published: Sep 16, 2024 - Affected: fixed in 2.5.4; from 3.0.0, fixed in 3.1.3. - Fixed in 2.5.4 (released May 20, 2024, 119 days before disclosure) and 3.1.3 (released May 11, 2024, 128 days before disclosure). - The latest release, 3.4.17, is not affected. - 1.2% of dompurify downloads last week were affected versions (1.3M). ### [CVE-2019-25155](https://cve.now/CVE-2019-25155): DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"'… - Severity: Unrated - Published: Oct 31, 2023 - Affected: fixed in 1.0.11. - Fixed in 1.0.11 (released Jun 18, 2019, 1596 days before disclosure). - The latest release, 3.4.17, is not affected. - <0.1% of dompurify downloads last week were affected versions (14.9K). ### [CVE-2020-26870](https://cve.now/CVE-2020-26870): Cure53 DOMPurify before 2.0.17 allows mutation XSS. - Severity: Unrated - Published: Oct 7, 2020 - Affected: fixed in 2.0.17. - Fixed in 2.0.17 (released Sep 20, 2020, 17 days before disclosure). - The latest release, 3.4.17, is not affected. - <0.1% of dompurify downloads last week were affected versions (76.7K). ### [CVE-2019-16728](https://cve.now/CVE-2019-16728): DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome… - Severity: Unrated - Published: Sep 24, 2019 - Affected: fixed in 2.0.3. - Fixed in 2.0.3 (released Sep 25, 2019, 1 day after disclosure). - The latest release, 3.4.17, is not affected. - <0.1% of dompurify downloads last week were affected versions (45.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/dompurify Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.