Is dompdf/dompdf 0.6 vulnerable?
Composer · 3 releases from 0.6.0 to 0.6.2 · latest dompdf/dompdf is 3.1.6 · checked 2 Nov 2026
Yes: 14 known advisories
Yes. dompdf/dompdf 0.6.2, the last 0.6 release, is affected by 14 known security advisories (4 critical, 1 high, 7 medium, 2 low), including CVE-2021-3902, CVE-2021-3838, CVE-2023-23924. 5 more affect earlier 0.6.x releases. Upgrade to 3.1.6 or later to fix all of them.
composer require dompdf/dompdf:^3.1.6Advisories affecting dompdf/dompdf 0.6.2
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Dompdf: File existence oracle via font-face stylesheet declaration
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Dompdf: Chroot Validation Bypass
- Affected
- <3.1.6
- Fixed in
- 3.1.6
Improper Restriction of XML External Entity Reference in dompdf/dompdf
- Affected
- <2.0.0
- Fixed in
- 2.0.0
Deserialization of Untrusted Data in dompdf/dompdf
- Affected
- <2.0.0
- Fixed in
- 2.0.0
Denial of service caused by infinite recursion when parsing SVG images
- Affected
- <2.0.4
- Fixed in
- 2.0.4
Dompdf vulnerable to URI validation failure on SVG parsing
- Affected
- <2.0.2
- Fixed in
- 2.0.2
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
- Affected
- <2.0.1
- Fixed in
- 2.0.1
Dompdf before v2.0.0 vulnerable to chroot check bypass
- Affected
- <2.0.0
- Fixed in
- 2.0.0
Server-Side Request Forgery in dompdf/dompdf
- Affected
- <2.0.0
- Fixed in
- 2.0.0
Remote code injection in dompdf/dompdf
- Affected
- <1.2.1
- Fixed in
- 1.2.1
Fixed within 0.6.x, affecting earlier releases
DOMPDF Remote Code Execution
- Affected
- >=0.6 <0.6.2
- Fixed in
- 0.6.2
DOMPDF Information Disclosure
- Affected
- >=0.6 <0.6.2
- Fixed in
- 0.6.2
DOMPDF denial of service vulnerability
- Affected
- >=0.6 <0.6.2
- Fixed in
- 0.6.2
DOMPDF Remote File Inclusion Vulnerability
- Affected
- >=0.6 <0.6.1
- Fixed in
- 0.6.1
DOMPDF Arbitrary File Read
- Affected
- >=0.6.0 <0.6.1
- Fixed in
- 0.6.1
Which of your client projects are still on dompdf/dompdf 0.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompdf/dompdf version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other dompdf/dompdf versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.