Skip to content
Noroxi

DOMPurify vulnerabilitiesDOMPurify: known vulnerabilities and safe versions

npm: dompurify

DOMPurify has 40 known vulnerability records: 29 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 11 only in Retire.js (CDN builds and advisories without a CVE).

By branch: 3.x is safe from 3.4.16; 2.x has no fixed release in the records; 1.x has no fixed release in the records; 0.9.x has no fixed release in the records.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
3.x——25high3.4.16
2.x——31criticalNo fix
1.x——30criticalNo fix
0.9.x——29criticalNo fix
0.8.x——32criticalNo fix
0.6.x——33criticalNo fix

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2026-1093452026-10-12

    DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

    Affected versions: < 3.4.16

    medium 5.1

    Fixed in: 3.4.16

  • CVE-2026-1093442026-10-12

    DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

    Affected versions: >= 3.4.13, < 3.4.16

    medium 5.1

    Fixed in: 3.4.16

  • CVE-2026-758382026-08-18

    DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

    Affected versions: < 3.4.13

    medium 5.1

    Fixed in: 3.4.13

  • CVE-2026-660102026-07-24

    DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

    Affected versions: < 3.4.12

    medium 5.1

    Fixed in: 3.4.12

  • CVE-2026-659142026-07-23

    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    Affected versions: < 3.3.2

    medium 5.3

    Fixed in: 3.3.2

  • CVE-2026-659132026-07-23

    DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    Affected versions: < 3.3.2

    medium 5.1

    Fixed in: 3.3.2

  • CVE-2026-659122026-07-23

    DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

    Affected versions: < 3.3.2

    medium 5.1

    Fixed in: 3.3.2

  • CVE-2026-659032026-07-23

    DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

    Affected versions: < 3.4.0

    medium 5.1

    Fixed in: 3.4.0

  • CVE-2026-659022026-07-23

    DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    Affected versions: < 3.4.7

    medium 5.3

    Fixed in: 3.4.7

  • CVE-2026-659012026-07-23

    DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

    Affected versions: <= 3.4.6 · < 3.4.7

    medium 5.1

    Fixed in: 3.4.7

  • CVE-2026-659002026-07-23

    DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

    Affected versions: >= 3.0.0, < 3.4.8

    medium 5.1

    Fixed in: 3.4.8

  • CVE-2026-658992026-07-23

    DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    Affected versions: < 3.4.9

    medium 5.1

    Fixed in: 3.4.9

  • CVE-2026-658982026-07-23

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    Affected versions: < 3.4.11

    medium 5.1

    Fixed in: 3.4.11

  • CVE-2026-499782026-07-14

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    Affected versions: < 3.4.7

    medium 6.3

    Fixed in: 3.4.7

  • CVE-2026-494592026-07-14

    DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

    Affected versions: < 3.4.6

    medium 6.1

    Fixed in: 3.4.6

  • CVE-2026-494582026-07-14

    DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

    Affected versions: < 3.4.6

    medium 6.1

    Fixed in: 3.4.6

  • CVE-2026-47423exploit code exists2026-07-14

    DOMPurify XSS via `selectedcontent` re-clone

    Affected versions: >= 3.4.4, < 3.4.5

    high 8.2

    Fixed in: 3.4.5

  • CVE-2026-412402026-04-23

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    Affected versions: < 3.4.0

    medium 6.0

    Fixed in: 3.4.0

  • CVE-2026-412392026-04-23

    DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

    Affected versions: >= 1.0.10, < 3.4.0

    medium 6.8

    Fixed in: 3.4.0

  • CVE-2026-412382026-04-23

    DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

    Affected versions: >= 3.0.1, < 3.4.0

    medium 6.9

    Fixed in: 3.4.0

  • CVE-2026-05402026-03-03

    DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

    Affected versions: >= 3.1.3, < 3.3.2 · >= 2.5.3, < 2.5.9

    medium 5.3

    Fixed in: 2.5.9, 3.3.2

  • CVE-2025-155992026-03-03

    DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

    Affected versions: >= 3.1.3, < 3.2.7 · >= 2.5.3, <= 2.5.8 · >= 2.5.3, < 2.5.9

    medium 5.1

    Fixed in: 2.5.9, 3.2.7

  • CVE-2025-267912025-02-14

    DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

    Affected versions: < 3.2.4

    medium 6.1

    Fixed in: 3.2.4

  • CVE-2024-48910exploit code exists2024-10-31

    DOMPurify vulnerable to tampering by prototype polution

    Affected versions: < 2.4.2

    critical 9.8

    Fixed in: 2.4.2

    EPSS 1.1%

  • CVE-2024-47875exploit code exists2024-10-11

    DOMPurify nesting-based mXSS

    Affected versions: < 2.5.0 · >= 3.0.0, < 3.1.3

    medium 6.1

    Fixed in: 2.5.0, 3.1.3

    EPSS 1.1%

  • CVE-2024-458012024-09-16

    Tampering by prototype polution in DOMPurify

    Affected versions: < 2.5.4 · >= 3.0.0, < 3.1.3

    medium 6.1

    Fixed in: 2.5.4, 3.1.3

  • CVE-2019-251552023-11-06

    DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' att

    Affected versions: < 1.0.11

    medium 6.1

    Fixed in: 1.0.11

  • CVE-2020-268702020-10-07

    Cure53 DOMPurify before 2.0.17 allows mutation XSS.

    Affected versions: < 2.0.17

    medium 6.1

    Fixed in: 2.0.17

    EPSS 4.8%

  • CVE-2019-167282019-09-24

    DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome a

    Affected versions: < 2.0.3

    medium 6.1

    Fixed in: 2.0.3

    EPSS 1.4%

  • no CVE

    Fixed a new MathML-based bypass submitted by PewGrand. Fixed a new SVG-related bypass submitted by SecurityMB

    Affected versions: < 2.2.4

    low

    Fixed in: 2.2.4

  • no CVE

    Fixed an mXSS issue reported

    Affected versions: < 2.2.3

    low

    Fixed in: 2.2.3

  • no CVE

    Fixed an mXSS bypass dropped on us publicly via

    Affected versions: < 2.2.2

    low

    Fixed in: 2.2.2

  • no CVE

    Fix a possible XSS in Chrome that is hidden behind #enable-experimental-web-platform-features

    Affected versions: < 2.2.0

    low

    Fixed in: 2.2.0

  • no CVE

    Fixed several possible mXSS patterns, thanks @hackvertor

    Affected versions: < 2.1.1

    low

    Fixed in: 2.1.1

  • no CVE

    Fixed an mXSS-based bypass caused by nested forms inside MathML

    Affected versions: < 2.0.16

    low

    Fixed in: 2.0.16

  • no CVE

    safari UXSS

    Affected versions: < 0.9.0

    low

    Fixed in: 0.9.0

  • no CVE

    safari UXSS

    Affected versions: < 0.8.9

    low

    Fixed in: 0.8.9

  • no CVE

    Affected versions: < 0.8.6

    medium

    Fixed in: 0.8.6

  • no CVE

    Affected versions: < 0.6.1

    medium

    Fixed in: 0.6.1

  • GHSA-mjjq-c88q-qhr6

    possible to bypass the package sanitization through Mutation XSS

    Affected versions: < 2.0.7

    high

    Fixed in: 2.0.7

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 22, 2026.

Other libraries