StackPrism

npm package

dompurify 2.5.3 vulnerabilities, and what to upgrade to

dompurify 2.5.3 has 20 known vulnerabilities (1 rated high or critical); 3.4.16 fixes 19 of them, and 1 has no fixed version yet.

npm (opens in a new tab) describes it as “DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is writ…”

Known vulnerabilities
20
1 rated high or critical
Released
May 11, 2024
Latest is 3.4.17
Downloads last week
2.5K
Under 1% of dompurify downloads
Licence
(MPL-2.0 OR Apache-2.0)
OpenSSF Scorecard
9.7/10
cure53/dompurify (opens in a new tab)
Dependencies
None
Resolved by deps.dev

What to upgrade to

3.4.16 is the closest release with no known vulnerabilities.

  • 2.5.9

    Newest 2.x release. Released Mar 5, 2026.

    17 known vulnerabilities, worst rated warning

  • 3.4.16Upgrade to this

    Fixes 19 of the 20 known vulnerabilities. Released Sep 23, 2026.

    No known vulnerabilities

  • 3.4.17

    Latest release. Released Oct 12, 2026.

    No known vulnerabilities

3.4.16 came out on Sep 23, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for dompurify 2.5.3

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. CriticalCVE-2024-45801 on OSV.dev (opens in a new tab)GHSA-mmhx-hmjr-r674EPSS: top 42%

    DOMPurify allows tampering by prototype pollution

    Fixed in 2.5.4. Published Sep 16, 2024.

  2. WarningCVE-2025-26791 on OSV.dev (opens in a new tab)GHSA-vhxf-7vqr-mrjgEPSS: top 53%

    DOMPurify allows Cross-site Scripting (XSS)

    Fixed in 3.2.4. Published Feb 14, 2025.

  3. WarningCVE-2026-41239 on OSV.dev (opens in a new tab)GHSA-crv5-9vww-q3g8EPSS: top 66%

    DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

    Fixed in 3.4.0. Published Apr 22, 2026.

  4. LowCVE-2026-65899 on OSV.dev (opens in a new tab)GHSA-vxr8-fq34-vvx9EPSS: top 66%

    DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

    Fixed in 3.4.9. Published Jun 15, 2026.

  5. WarningCVE-2026-49978 on OSV.dev (opens in a new tab)GHSA-rp9w-3fw7-7cwqEPSS: top 67%

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    Fixed in 3.4.7. Published Jun 15, 2026.

  6. WarningCVE-2026-49458 on OSV.dev (opens in a new tab)GHSA-hpcv-96wg-7vj8EPSS: top 67%

    DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

    Fixed in 3.4.6. Published Jun 15, 2026.

  7. WarningCVE-2026-41240 on OSV.dev (opens in a new tab)GHSA-h7mw-gpvr-xq4mEPSS: top 67%

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    Fixed in 3.4.0. Published Apr 22, 2026.

  8. WarningCVE-2026-49459 on OSV.dev (opens in a new tab)GHSA-r47g-fvhr-h676EPSS: top 72%

    DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

    Fixed in 3.4.6. Published Jun 15, 2026.

  9. WarningCVE-2026-65902 on OSV.dev (opens in a new tab)GHSA-76mc-f452-cxcmEPSS: top 73%

    DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

    Fixed in 3.4.7. Published Jun 15, 2026.

  10. WarningCVE-2026-0540 on OSV.dev (opens in a new tab)GHSA-v2wj-7wpq-c8vvEPSS: top 74%

    DOMPurify contains a Cross-site Scripting vulnerability

    Fixed in 2.5.9. Published Mar 3, 2026.

  11. WarningCVE-2026-65903 on OSV.dev (opens in a new tab)GHSA-39q2-94rc-95cpEPSS: top 77%

    DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

    Fixed in 3.4.0. Published Apr 16, 2026.

  12. WarningCVE-2026-65913 on OSV.dev (opens in a new tab)GHSA-cj63-jhhr-wcxvEPSS: top 77%

    DOMPurify USE_PROFILES prototype pollution allows event handlers

    Fixed in 3.3.2. Published Apr 3, 2026.

  13. WarningCVE-2026-65914 on OSV.dev (opens in a new tab)GHSA-h8r8-wccr-v5f2EPSS: top 79%

    DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

    Fixed in 3.3.2. Published Mar 27, 2026.

  14. LowCVE-2026-66010 on OSV.dev (opens in a new tab)GHSA-c2j3-45gr-mqc4EPSS: top 79%

    DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

    Fixed in 3.4.12. Published Jul 21, 2026.

  15. WarningCVE-2026-75838 on OSV.dev (opens in a new tab)GHSA-55q2-fjhq-7xh7EPSS: top 79%

    DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

    Fixed in 3.4.13. Published Aug 7, 2026.

  16. WarningCVE-2026-65912 on OSV.dev (opens in a new tab)GHSA-cjmm-f4jc-qw8rEPSS: top 79%

    DOMPurify ADD_ATTR predicate skips URI validation

    Fixed in 3.3.2. Published Apr 3, 2026.

  17. WarningCVE-2026-65898 on OSV.dev (opens in a new tab)GHSA-cmwh-pvxp-8882EPSS: top 79%

    DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

    Fixed in 3.4.11. Published Jun 18, 2026.

  18. LowCVE-2026-65901 on OSV.dev (opens in a new tab)GHSA-x4vx-rjvf-j5p4EPSS: top 81%

    DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

    No fixed version listed yet. Published Jun 15, 2026.

  19. WarningCVE-2025-15599 on OSV.dev (opens in a new tab)GHSA-v8jm-5vwx-cfxmEPSS: top 85%

    DOMPurify contains a Cross-site Scripting vulnerability

    Fixed in 3.2.7. Published Mar 3, 2026.

  20. LowCVE-2026-109345 on OSV.dev (opens in a new tab)GHSA-6688-9rhm-gjv2EPSS: top 91%

    DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

    Fixed in 3.4.16. Published Oct 5, 2026.

Who is still on a vulnerable dompurify

70% of last week’s 71.6M dompurify downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Is dompurify the only one?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly dompurify 2.5.3, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against npm, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.