Bootstrap vulnerabilitiesBootstrap: known vulnerabilities and safe versions
npm: bootstrap
Bootstrap has 10 known vulnerability records: 9 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 1 only in Retire.js (CDN builds and advisories without a CVE). The latest release is 5.3.8 (endoflife.date).
By branch: 5.x has no known records; 4.x is safe from 4.3.1; 3.x has no fixed release in the records; 2.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 5.x | Supported | 5.3.8 | 0 | — |
| 4.x | Ended (January 1, 2023) | 4.6.2 | 4medium | 4.3.1 |
| 3.x | Ended (July 24, 2019) | 3.4.1 | 8medium | No fix |
| 2.x | Ended (August 19, 2013) | 2.3.2 | 7medium | No fix |
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2025-16472025-05-15
XSS in Bootstrap title attribute for Tooltip and Popover
Affected versions: = 3.4.1 · >= 3.4.1, < 3.4.2
medium 5.6
Fixed in: 3.4.2
CVE-2024-6485exploit code exists2024-07-11
XSS in Bootstrap button component
Affected versions: >= 1.4.0, <= 3.4.1 · >= 1.4.0, < 3.4.2
medium 6.4
Fixed in: 3.4.2
CVE-2019-8331exploit code exists2019-02-20
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Affected versions: >= 4.0.0, < 4.3.1 · >= 3.0.0, < 3.4.1
medium 6.1
Fixed in: 3.4.1, 4.3.1
EPSS 16.4%
CVE-2018-206772019-01-09
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Affected versions: < 3.4.0
medium 6.1
Fixed in: 3.4.0
EPSS 3.9%
CVE-2018-206762019-01-09
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Affected versions: < 3.4.0
medium 6.1
Fixed in: 3.4.0
EPSS 3.8%
CVE-2016-10735exploit code exists2019-01-09
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than
Affected versions: >= 2.0.4, < 3.4.0 · >= 4.0.0-beta, < 4.0.0-beta.2 · >= 3.0.0, < 3.4.0
medium 6.1
Fixed in: 3.4.0
EPSS 4%
CVE-2018-14042exploit code exists2018-07-13
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
Affected versions: >= 4.0.0, < 4.1.2 · >= 2.3.0, < 3.4.0
medium 6.1
Fixed in: 3.4.0, 4.1.2
EPSS 4%
CVE-2018-14041exploit code exists2018-07-13
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
Affected versions: >= 4.0.0, < 4.1.2
medium 6.1
Fixed in: 4.1.2
EPSS 4.3%
CVE-2018-14040exploit code exists2018-07-13
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
Affected versions: >= 4.0.0, < 4.1.2 · >= 2.3.0, < 3.4.0
medium 6.1
Fixed in: 3.4.0, 4.1.2
EPSS 4.1%
no CVE
cross-site scripting vulnerability
Affected versions: < 2.1.0
medium
Fixed in: 2.1.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 22, 2026.