StackPrism

npm package

dompurify 1.0.4 vulnerabilities, and what to upgrade to

dompurify 1.0.4 has 23 known vulnerabilities (4 rated high or critical); 3.4.16 fixes 22 of them, and 1 has no fixed version yet.

npm (opens in a new tab) describes it as “DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is writ…”

Known vulnerabilities
23
4 rated high or critical
Released
Apr 28, 2018
Latest is 3.4.17
Downloads last week
350
Under 1% of dompurify downloads
Licence
(MPL-2.0 OR Apache-2.0)
OpenSSF Scorecard
9.7/10
cure53/dompurify (opens in a new tab)
Dependencies
None
Resolved by deps.dev

What to upgrade to

3.4.16 is the closest release with no known vulnerabilities.

  • 1.0.11

    Newest 1.x release. Released Jun 18, 2019.

    23 known vulnerabilities, worst rated warning

  • 3.4.16Upgrade to this

    Fixes 22 of the 23 known vulnerabilities. Released Sep 23, 2026.

    No known vulnerabilities

  • 3.4.17

    Latest release. Released Oct 12, 2026.

    No known vulnerabilities

3.4.16 came out on Sep 23, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for dompurify 1.0.4

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. WarningCVE-2020-26870 on OSV.dev (opens in a new tab)GHSA-63q7-h895-m982EPSS: top 9%

    Cross-site Scripting in dompurify

    Fixed in 2.0.17. Published Dec 18, 2020.

  2. WarningCVE-2019-16728 on OSV.dev (opens in a new tab)GHSA-chqj-j4fh-rw7mEPSS: top 24%

    Cross-Site Scripting in dompurify

    Fixed in 2.0.3. Published Aug 28, 2020.

  3. CriticalCVE-2024-48910 on OSV.dev (opens in a new tab)GHSA-p3vf-v8qc-cwcrEPSS: top 34%

    DOMPurify vulnerable to tampering by prototype polution

    Fixed in 2.4.2. Published Oct 31, 2024.

  4. CriticalCVE-2024-47875 on OSV.dev (opens in a new tab)GHSA-gx9m-whjm-85jfEPSS: top 35%

    DOMpurify has a nesting-based mXSS

    Fixed in 2.5.0. Published Oct 11, 2024.

  5. CriticalCVE-2024-45801 on OSV.dev (opens in a new tab)GHSA-mmhx-hmjr-r674EPSS: top 42%

    DOMPurify allows tampering by prototype pollution

    Fixed in 2.5.4. Published Sep 16, 2024.

  6. WarningCVE-2025-26791 on OSV.dev (opens in a new tab)GHSA-vhxf-7vqr-mrjgEPSS: top 53%

    DOMPurify allows Cross-site Scripting (XSS)

    Fixed in 3.2.4. Published Feb 14, 2025.

  7. WarningCVE-2019-25155 on OSV.dev (opens in a new tab)GHSA-8hgg-xxm5-3873EPSS: top 58%

    DOMPurify Open Redirect vulnerability

    Fixed in 1.0.11. Published Nov 14, 2023.

  8. LowCVE-2026-65899 on OSV.dev (opens in a new tab)GHSA-vxr8-fq34-vvx9EPSS: top 66%

    DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

    Fixed in 3.4.9. Published Jun 15, 2026.

  9. WarningCVE-2026-49978 on OSV.dev (opens in a new tab)GHSA-rp9w-3fw7-7cwqEPSS: top 67%

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    Fixed in 3.4.7. Published Jun 15, 2026.

  10. WarningCVE-2026-49458 on OSV.dev (opens in a new tab)GHSA-hpcv-96wg-7vj8EPSS: top 67%

    DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

    Fixed in 3.4.6. Published Jun 15, 2026.

  11. WarningCVE-2026-41240 on OSV.dev (opens in a new tab)GHSA-h7mw-gpvr-xq4mEPSS: top 67%

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    Fixed in 3.4.0. Published Apr 22, 2026.

  12. WarningCVE-2026-49459 on OSV.dev (opens in a new tab)GHSA-r47g-fvhr-h676EPSS: top 72%

    DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

    Fixed in 3.4.6. Published Jun 15, 2026.

  13. WarningCVE-2026-65902 on OSV.dev (opens in a new tab)GHSA-76mc-f452-cxcmEPSS: top 73%

    DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

    Fixed in 3.4.7. Published Jun 15, 2026.

  14. WarningCVE-2026-65903 on OSV.dev (opens in a new tab)GHSA-39q2-94rc-95cpEPSS: top 77%

    DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

    Fixed in 3.4.0. Published Apr 16, 2026.

  15. WarningCVE-2026-65913 on OSV.dev (opens in a new tab)GHSA-cj63-jhhr-wcxvEPSS: top 77%

    DOMPurify USE_PROFILES prototype pollution allows event handlers

    Fixed in 3.3.2. Published Apr 3, 2026.

  16. WarningCVE-2026-65914 on OSV.dev (opens in a new tab)GHSA-h8r8-wccr-v5f2EPSS: top 79%

    DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

    Fixed in 3.3.2. Published Mar 27, 2026.

  17. LowCVE-2026-66010 on OSV.dev (opens in a new tab)GHSA-c2j3-45gr-mqc4EPSS: top 79%

    DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

    Fixed in 3.4.12. Published Jul 21, 2026.

  18. WarningCVE-2026-75838 on OSV.dev (opens in a new tab)GHSA-55q2-fjhq-7xh7EPSS: top 79%

    DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

    Fixed in 3.4.13. Published Aug 7, 2026.

  19. WarningCVE-2026-65912 on OSV.dev (opens in a new tab)GHSA-cjmm-f4jc-qw8rEPSS: top 79%

    DOMPurify ADD_ATTR predicate skips URI validation

    Fixed in 3.3.2. Published Apr 3, 2026.

  20. WarningCVE-2026-65898 on OSV.dev (opens in a new tab)GHSA-cmwh-pvxp-8882EPSS: top 79%

    DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

    Fixed in 3.4.11. Published Jun 18, 2026.

  21. LowCVE-2026-65901 on OSV.dev (opens in a new tab)GHSA-x4vx-rjvf-j5p4EPSS: top 81%

    DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

    No fixed version listed yet. Published Jun 15, 2026.

  22. LowCVE-2026-109345 on OSV.dev (opens in a new tab)GHSA-6688-9rhm-gjv2EPSS: top 91%

    DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

    Fixed in 3.4.16. Published Oct 5, 2026.

  23. CriticalGHSA-mjjq-c88q-qhr6 on OSV.dev (opens in a new tab)

    Cross-Site Scripting in dompurify

    Fixed in 2.0.7. Published Sep 3, 2020.

Who is still on a vulnerable dompurify

70% of last week’s 71.6M dompurify downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Is dompurify the only one?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly dompurify 1.0.4, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against npm, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.