StackPrism

npm package

dompurify 3.4.13 vulnerabilities, and the version that fixes all of them

dompurify 3.4.13 has 2 known vulnerabilities; 3.4.16 fixes all of them.

npm (opens in a new tab) describes it as “DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is writ…”

Known vulnerabilities
2
None rated high or critical
Released
Aug 3, 2026
Latest is 3.4.17
Downloads last week
6.6M
9% of dompurify downloads
Licence
(MPL-2.0 OR Apache-2.0)
OpenSSF Scorecard
9.7/10
cure53/dompurify (opens in a new tab)
Pulls in
1 package
Resolved by deps.dev

What to upgrade to

3.4.16 is the closest release with no known vulnerabilities.

  • 3.4.16Upgrade to this

    Fixes all 2 known vulnerabilities. Released Sep 23, 2026.

    No known vulnerabilities

  • 3.4.17

    Newest 3.x release and the latest release. Released Oct 12, 2026.

    No known vulnerabilities

3.4.16 came out on Sep 23, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Findings

Every advisory for dompurify 3.4.13

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. LowCVE-2026-109345 on OSV.dev (opens in a new tab)GHSA-6688-9rhm-gjv2EPSS: top 91%

    DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

    Fixed in 3.4.16. Published Oct 5, 2026.

  2. LowCVE-2026-109344 on OSV.dev (opens in a new tab)GHSA-p98j-92pf-mc4pEPSS: top 93%

    DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

    Fixed in 3.4.16. Published Sep 30, 2026.

Who is still on a vulnerable dompurify

70% of last week’s 71.6M dompurify downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Is dompurify the only one?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly dompurify 3.4.13, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against npm, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.