dompurify

3.4.17 · 12 Oct 2026(MPL-2.0 OR Apache-2.0)42.1M / weekRepository npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	3.4.17	Safe from 3.4.16
	2.5.9	17 open advisories, worst moderate
	1.1.1	138 open advisories, worst critical · last release Dec 2017, no longer updated

Your version

Critical
DOMPurify vulnerable to tampering by prototype polutionGHSA-p3vf-v8qc-cwcr · 31 Oct 2024
- 2.x2.0.0 – 2.4.1Fixed in 2.4.2
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.4.2
Critical
Cross-Site Scripting in dompurifyGHSA-mjjq-c88q-qhr6 · 3 Sep 2020
- 2.x2.0.0 – 2.0.6Fixed in 2.0.7
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.0.7
High
DOMPurify XSS via selectedcontent re-cloneGHSA-87xg-pxx2-7hvx · 1 Jun 2026
- 3.x3.4.4Fixed in 3.4.5
High
DOMpurify has a nesting-based mXSSGHSA-gx9m-whjm-85jf · 11 Oct 2024
- 3.x3.0.0 – 3.1.2Fixed in 3.1.3
- 2.x2.0.0 – 2.4.9Fixed in 2.5.0
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.5.0
High
DOMPurify allows tampering by prototype pollutionGHSA-mmhx-hmjr-r674 · 16 Sep 2024
- 3.x3.0.0 – 3.1.2Fixed in 3.1.3
- 2.x2.0.0 – 2.5.3Fixed in 2.5.4
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.5.4
Moderate
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSGHSA-55q2-fjhq-7xh7 · 7 Aug 2026
- 3.x3.0.0 – 3.4.12Fixed in 3.4.13
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.13
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.13
Moderate
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)GHSA-cmwh-pvxp-8882 · 18 Jun 2026
- 3.x3.0.0 – 3.4.10Fixed in 3.4.11
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.11
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.11
Moderate
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentGHSA-rp9w-3fw7-7cwq · 15 Jun 2026
- 3.x3.0.0 – 3.4.6Fixed in 3.4.7
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.7
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.7
Moderate
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`GHSA-76mc-f452-cxcm · 15 Jun 2026
- 3.x3.0.0 – 3.4.6Fixed in 3.4.7
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.7
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.7
Moderate
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksGHSA-hpcv-96wg-7vj8 · 15 Jun 2026
- 3.x3.0.0 – 3.4.5Fixed in 3.4.6
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.6
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.6
Moderate
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMGHSA-r47g-fvhr-h676 · 15 Jun 2026
- 3.x3.0.0 – 3.4.5Fixed in 3.4.6
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.6
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.6
Moderate
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)GHSA-h7mw-gpvr-xq4m · 22 Apr 2026
- 3.x3.0.0 – 3.3.3Fixed in 3.4.0
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.0
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.0
Moderate
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeGHSA-crv5-9vww-q3g8 · 22 Apr 2026
- 3.x3.0.0 – 3.3.3Fixed in 3.4.0
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.0
- 1.x1.0.10 – 1.1.1No fix on 1.x · move to 3.4.0
Moderate
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackGHSA-v9jr-rg53-9pgp · 22 Apr 2026
- 3.x3.0.1 – 3.3.3Fixed in 3.4.0
Moderate
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluationGHSA-39q2-94rc-95cp · 16 Apr 2026
- 3.x3.0.0 – 3.3.3Fixed in 3.4.0
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.0
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.0
Moderate
DOMPurify ADD_ATTR predicate skips URI validationGHSA-cjmm-f4jc-qw8r · 3 Apr 2026
- 3.x3.0.0 – 3.3.1Fixed in 3.3.2
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.3.2
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.3.2
Moderate
DOMPurify USE_PROFILES prototype pollution allows event handlersGHSA-cj63-jhhr-wcxv · 3 Apr 2026
- 3.x3.0.0 – 3.3.1Fixed in 3.3.2
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.3.2
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.3.2
Moderate
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization GHSA-h8r8-wccr-v5f2 · 27 Mar 2026
- 3.x3.0.0 – 3.3.1Fixed in 3.3.2
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.3.2
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.3.2
Moderate
DOMPurify contains a Cross-site Scripting vulnerabilityGHSA-v2wj-7wpq-c8vv · 3 Mar 2026
- 3.x3.1.3 – 3.3.1Fixed in 3.3.2
- 2.x2.5.3 – 2.5.8Fixed in 2.5.9
Moderate
DOMPurify contains a Cross-site Scripting vulnerabilityGHSA-v8jm-5vwx-cfxm · 3 Mar 2026
- 3.x3.1.3 – 3.2.6Fixed in 3.2.7
- 2.x2.5.3 – 2.5.8Fixed in 2.5.9
Moderate
DOMPurify allows Cross-site Scripting (XSS)GHSA-vhxf-7vqr-mrjg · 14 Feb 2025
- 3.x3.0.0 – 3.2.3Fixed in 3.2.4
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.2.4
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.2.4
Moderate
DOMPurify Open Redirect vulnerabilityGHSA-8hgg-xxm5-3873 · 14 Nov 2023
- 1.x1.0.0 – 1.0.10Fixed in 1.0.11
- 0.9.x and older0.4.0 – 0.9.0No fix, no longer updated · move to 1.0.11
Moderate
Cross-site Scripting in dompurifyGHSA-63q7-h895-m982 · 18 Dec 2020
- 2.x2.0.0 – 2.0.16Fixed in 2.0.17
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.0.17
Moderate
Cross-Site Scripting in dompurifyGHSA-chqj-j4fh-rw7m · 28 Aug 2020
- 2.x2.0.0 – 2.0.2Fixed in 2.0.3
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 2.0.3
Low
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executesGHSA-6688-9rhm-gjv2 · 5 Oct 2026
- 3.x3.0.0 – 3.4.15Fixed in 3.4.16
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.16
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.16
Low
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSSGHSA-p98j-92pf-mc4p · 30 Sep 2026
- 3.x3.4.13 – 3.4.15Fixed in 3.4.16
Low
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.GHSA-c2j3-45gr-mqc4 · 21 Jul 2026
- 3.x3.0.0 – 3.4.11Fixed in 3.4.12
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.12
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.12
Low
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` outputGHSA-vxr8-fq34-vvx9 · 15 Jun 2026
- 3.x3.0.0 – 3.4.8Fixed in 3.4.9
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.9
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.9
Low
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesGHSA-gvmj-g25r-r7wr · 15 Jun 2026
- 3.x3.0.0 – 3.4.7Fixed in 3.4.8
Low
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objectsGHSA-x4vx-rjvf-j5p4 · 15 Jun 2026
- 3.x3.0.0 – 3.4.6Fixed in 3.4.7
- 2.x2.0.0 – 2.5.9No fix on 2.x · move to 3.4.7
- 1.x and older0.4.0 – 1.1.1No fix, no longer updated · move to 3.4.7

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.