# jquery (npm) vulnerabilities 8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.0 (Jan 18, 2026): no advisory affects it - Newest unaffected release: 4.0.0 (Jan 18, 2026), the latest release - Weekly downloads: 17.8M - Dependents: 5,501 - Releases: 64 since 1.5.1 (Mar 19, 2011) - Registry: https://www.npmjs.com/package/jquery - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2020-7656: 1.5.1 to 1.8.3 (1.9.1 is outside it) - CVE-2020-11023: 1.5.1 to 3.4.1 (3.5.0 is outside it) - CVE-2020-11022: 1.12.0 to 3.4.1 (3.5.0 is outside it) - CVE-2019-11358: 1.5.1 to 3.3.1 (3.4.0 is outside it) - CVE-2016-10707: 3.0.0-rc1 (3.0.0 is outside it) - CVE-2015-9251: 1.5.1 to 1.12.1 (1.12.2 is outside it); 1.12.3 to 3.0.0-rc1 (3.0.0 is outside it) - CVE-2012-6708: 1.5.1 to 1.8.3 (1.9.1 is outside it) - CVE-2011-4969: 1.5.1 to 1.6.2 (1.6.3 is outside it) ## Advisories (8) ### [CVE-2020-7656](https://cve.now/CVE-2020-7656): jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. - Severity: Unrated - Published: May 19, 2020 - Affected: from 1.2.1, fixed in 1.9.0. - Fixed in 1.9.1 (released Jul 17, 2014, 2133 days before disclosure, the advisory names 1.9.0, which was never published). - The latest release, 4.0.0, is not affected. - <0.1% of jquery downloads last week were affected versions (4.8K). ### [CVE-2020-11023](https://cve.now/CVE-2020-11023): Potential XSS vulnerability in jQuery - Severity: Medium 6.9 · KEV - Published: Apr 29, 2020 - Affected: from 1.0.3, fixed in 3.5.0. - Fixed in 3.5.0 (released Apr 10, 2020, 19 days before disclosure). - The latest release, 4.0.0, is not affected. - 5.2% of jquery downloads last week were affected versions (1.2M). ### [CVE-2020-11022](https://cve.now/CVE-2020-11022): jQuery has a potential XSS vulnerability - Severity: Medium 6.9 - Published: Apr 29, 2020 - Affected: from 1.12.0, fixed in 3.5.0. - Fixed in 3.5.0 (released Apr 10, 2020, 19 days before disclosure). - The latest release, 4.0.0, is not affected. - 4.8% of jquery downloads last week were affected versions (1.1M). ### [CVE-2019-11358](https://cve.now/CVE-2019-11358): jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of… - Severity: Unrated - Published: Apr 19, 2019 - Affected: from 1.1.4, fixed in 3.4.0. - Fixed in 3.4.0 (released Apr 10, 2019, 9 days before disclosure). - The latest release, 4.0.0, is not affected. - 4.1% of jquery downloads last week were affected versions (947.7K). ### [CVE-2016-10707](https://cve.now/CVE-2016-10707): jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. - Severity: Unrated - Published: Jan 18, 2018 - Affected: from 3.0.0-rc.1, fixed in 3.0.0. - Fixed in 3.0.0 (released Jun 9, 2016, 588 days before disclosure). - The latest release, 4.0.0, is not affected. - <0.1% of jquery downloads last week were affected versions (47). ### [CVE-2015-9251](https://cve.now/CVE-2015-9251): jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType… - Severity: Unrated - Published: Jan 18, 2018 - Affected: fixed in 1.12.2; from 1.12.3, fixed in 3.0.0. - Fixed in 1.12.2 (released Mar 17, 2016, 672 days before disclosure) and 3.0.0 (released Jun 9, 2016, 588 days before disclosure). - The latest release, 4.0.0, is not affected. - 3.1% of jquery downloads last week were affected versions (710.7K). ### [CVE-2012-6708](https://cve.now/CVE-2012-6708): jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. - Severity: Unrated - Published: Jan 18, 2018 - Affected: fixed in 1.9.0. - Fixed in 1.9.1 (released Jul 17, 2014, 1281 days before disclosure, the advisory names 1.9.0, which was never published). - The latest release, 4.0.0, is not affected. - <0.1% of jquery downloads last week were affected versions (4.8K). ### [CVE-2011-4969](https://cve.now/CVE-2011-4969): Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to… - Severity: Unrated - Published: Mar 8, 2013 - Affected: fixed in 1.6.3. - Fixed in 1.6.3 (released Sep 12, 2011, 543 days before disclosure). - The latest release, 4.0.0, is not affected. - <0.1% of jquery downloads last week were affected versions (814). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/jquery Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.