npmPackage

jquery

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release: 4.0.0 (Jan 18, 2026): no advisory affects it
Newest unaffected release: 4.0.0 (Jan 18, 2026), the latest release
Advisories: 8 · 2 medium

Weekly downloads: 17.8M
Dependents: 5,501
Releases: 64 since 1.5.1 (Mar 19, 2011)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2020-7656
Affects 1.5.1 to 1.8.3 (1.9.1 is outside it)
CVE-2020-11023
Affects 1.5.1 to 3.4.1 (3.5.0 is outside it)
CVE-2020-11022
Affects 1.12.0 to 3.4.1 (3.5.0 is outside it)
CVE-2019-11358
Affects 1.5.1 to 3.3.1 (3.4.0 is outside it)
CVE-2016-10707
Affects 3.0.0-rc1 (3.0.0 is outside it)
CVE-2015-9251
Affects 1.5.1 to 1.12.1 (1.12.2 is outside it); 1.12.3 to 3.0.0-rc1 (3.0.0 is outside it)
CVE-2012-6708
Affects 1.5.1 to 1.8.3 (1.9.1 is outside it)
CVE-2011-4969
Affects 1.5.1 to 1.6.2 (1.6.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2020-7656Unrated
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.
Affected: from 1.2.1, fixed in 1.9.0.
Fixed in 1.9.1 (released Jul 17, 2014, 2133 days before disclosure, the advisory names 1.9.0, which was never published).
The latest release, 4.0.0, is not affected.
<0.1% of jquery downloads last week were affected versions (4.8K).
CVE-2020-11023Medium 6.9 · KEV
Potential XSS vulnerability in jQuery
Affected: from 1.0.3, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 10, 2020, 19 days before disclosure).
The latest release, 4.0.0, is not affected.
5.2% of jquery downloads last week were affected versions (1.2M).
CVE-2020-11022Medium 6.9
jQuery has a potential XSS vulnerability
Affected: from 1.12.0, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 10, 2020, 19 days before disclosure).
The latest release, 4.0.0, is not affected.
4.8% of jquery downloads last week were affected versions (1.1M).
CVE-2019-11358Unrated
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…
Affected: from 1.1.4, fixed in 3.4.0.
Fixed in 3.4.0 (released Apr 10, 2019, 9 days before disclosure).
The latest release, 4.0.0, is not affected.
4.1% of jquery downloads last week were affected versions (947.7K).
CVE-2016-10707Unrated
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.
Affected: from 3.0.0-rc.1, fixed in 3.0.0.
Fixed in 3.0.0 (released Jun 9, 2016, 588 days before disclosure).
The latest release, 4.0.0, is not affected.
<0.1% of jquery downloads last week were affected versions (47).
CVE-2015-9251Unrated
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType…
Affected: fixed in 1.12.2; from 1.12.3, fixed in 3.0.0.
Fixed in 1.12.2 (released Mar 17, 2016, 672 days before disclosure) and 3.0.0 (released Jun 9, 2016, 588 days before disclosure).
The latest release, 4.0.0, is not affected.
3.1% of jquery downloads last week were affected versions (710.7K).
CVE-2012-6708Unrated
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
Affected: fixed in 1.9.0.
Fixed in 1.9.1 (released Jul 17, 2014, 1281 days before disclosure, the advisory names 1.9.0, which was never published).
The latest release, 4.0.0, is not affected.
<0.1% of jquery downloads last week were affected versions (4.8K).
CVE-2011-4969Unrated
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to…
Affected: fixed in 1.6.3.
Fixed in 1.6.3 (released Sep 12, 2011, 543 days before disclosure).
The latest release, 4.0.0, is not affected.
<0.1% of jquery downloads last week were affected versions (814).