Packages / dompurify / Security

CriticalVulnerabilityGHSA-p3vf-v8qc-cwcrCVE-2024-48910Published 31 Oct 2024

DOMPurify vulnerable to tampering by prototype polution

Affected releases · dompurify

  • 2.x2.0.0 – 2.4.1Fixed in 2.4.2
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 2.x, the newest line:

npm install dompurify@2.4.2
3.x

  1. Not affected

    3.0.0 – 3.4.17

    50 releases, latest

2.x

  1. Affected

    2.0.0 – 2.4.1

    45 releases

  2. Fixed

    2.4.2 – 2.5.9

    18 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

dompurify was vulnerable to prototype pollution

Fixed by d1dd037