StackPrism

npm package

dompurify 3.4.5 vulnerabilities, and what to upgrade to

dompurify 3.4.5 has 11 known vulnerabilities; 3.4.16 fixes 10 of them, and 1 has no fixed version yet.

npm (opens in a new tab) describes it as “DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is writ…”

Known vulnerabilities
11
None rated high or critical
Released
May 18, 2026
Latest is 3.4.17
Downloads last week
967.2K
1% of dompurify downloads
Licence
(MPL-2.0 OR Apache-2.0)
OpenSSF Scorecard
9.7/10
cure53/dompurify (opens in a new tab)
Pulls in
1 package
Resolved by deps.dev

What to upgrade to

3.4.16 is the closest release with no known vulnerabilities.

  • 3.4.16Upgrade to this

    Fixes 10 of the 11 known vulnerabilities. Released Sep 23, 2026.

    No known vulnerabilities

  • 3.4.17

    Newest 3.x release and the latest release. Released Oct 12, 2026.

    No known vulnerabilities

3.4.16 came out on Sep 23, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for dompurify 3.4.5

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. LowCVE-2026-65899 on OSV.dev (opens in a new tab)GHSA-vxr8-fq34-vvx9EPSS: top 66%

    DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

    Fixed in 3.4.9. Published Jun 15, 2026.

  2. WarningCVE-2026-49978 on OSV.dev (opens in a new tab)GHSA-rp9w-3fw7-7cwqEPSS: top 67%

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    Fixed in 3.4.7. Published Jun 15, 2026.

  3. WarningCVE-2026-49458 on OSV.dev (opens in a new tab)GHSA-hpcv-96wg-7vj8EPSS: top 67%

    DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

    Fixed in 3.4.6. Published Jun 15, 2026.

  4. WarningCVE-2026-49459 on OSV.dev (opens in a new tab)GHSA-r47g-fvhr-h676EPSS: top 72%

    DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

    Fixed in 3.4.6. Published Jun 15, 2026.

  5. WarningCVE-2026-65902 on OSV.dev (opens in a new tab)GHSA-76mc-f452-cxcmEPSS: top 73%

    DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

    Fixed in 3.4.7. Published Jun 15, 2026.

  6. LowCVE-2026-65900 on OSV.dev (opens in a new tab)GHSA-gvmj-g25r-r7wrEPSS: top 78%

    DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

    Fixed in 3.4.8. Published Jun 15, 2026.

  7. LowCVE-2026-66010 on OSV.dev (opens in a new tab)GHSA-c2j3-45gr-mqc4EPSS: top 79%

    DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

    Fixed in 3.4.12. Published Jul 21, 2026.

  8. WarningCVE-2026-75838 on OSV.dev (opens in a new tab)GHSA-55q2-fjhq-7xh7EPSS: top 79%

    DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

    Fixed in 3.4.13. Published Aug 7, 2026.

  9. WarningCVE-2026-65898 on OSV.dev (opens in a new tab)GHSA-cmwh-pvxp-8882EPSS: top 79%

    DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

    Fixed in 3.4.11. Published Jun 18, 2026.

  10. LowCVE-2026-65901 on OSV.dev (opens in a new tab)GHSA-x4vx-rjvf-j5p4EPSS: top 81%

    DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

    No fixed version listed yet. Published Jun 15, 2026.

  11. LowCVE-2026-109345 on OSV.dev (opens in a new tab)GHSA-6688-9rhm-gjv2EPSS: top 91%

    DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

    Fixed in 3.4.16. Published Oct 5, 2026.

Who is still on a vulnerable dompurify

70% of last week’s 71.6M dompurify downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Is dompurify the only one?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly dompurify 3.4.5, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against npm, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.