Is dompdf/dompdf 0.8 vulnerable?

Composer · 7 releases from 0.8.0 to 0.8.6 · latest dompdf/dompdf is 3.1.6 · checked 2 Nov 2026

Yes: 14 known advisories

Yes. dompdf/dompdf 0.8.6, the last 0.8 release, is affected by 14 known security advisories (4 critical, 1 high, 7 medium, 2 low), including CVE-2021-3902, CVE-2021-3838, CVE-2023-23924. Upgrade to 3.1.6 or later to fix all of them.

Upgrade with:composer require dompdf/dompdf:^3.1.6

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting dompdf/dompdf 0.8.6

  • MediumCVE-2026-59943GHSA-j8qw-6jw8-r29722 Jul 2026

    Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59942GHSA-f5gf-2cj8-52g222 Jul 2026

    Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59941GHSA-8hg6-c449-896m22 Jul 2026

    Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-56722GHSA-cx96-42px-69fm22 Jul 2026

    Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55555GHSA-7x2p-4jvh-638422 Jul 2026

    Dompdf: File existence oracle via font-face stylesheet declaration

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55554GHSA-wvh6-f5jh-8gw422 Jul 2026

    Dompdf: Chroot Validation Bypass

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • CriticalCVE-2021-3902GHSA-3vjh-xrhf-v9xh15 Nov 2024

    Improper Restriction of XML External Entity Reference in dompdf/dompdf

    Affected
    <2.0.0
    Fixed in
    2.0.0
  • CriticalCVE-2021-3838GHSA-577p-7j7h-2jgf15 Nov 2024

    Deserialization of Untrusted Data in dompdf/dompdf

    Affected
    <2.0.0
    Fixed in
    2.0.0
  • MediumCVE-2023-50262GHSA-3qx2-6f78-w2j213 Dec 2023

    Denial of service caused by infinite recursion when parsing SVG images

    Affected
    <2.0.4
    Fixed in
    2.0.4
  • CriticalCVE-2023-23924GHSA-3cw5-7cxw-v5qg1 Feb 2023

    Dompdf vulnerable to URI validation failure on SVG parsing

    Affected
    <2.0.2
    Fixed in
    2.0.2
  • HighCVE-2022-41343GHSA-6x28-7h8c-chx426 Sept 2022

    Dompdf allows remote file inclusion because URI validation failure does not halt font registration

    Affected
    <2.0.1
    Fixed in
    2.0.1
  • MediumCVE-2022-2400GHSA-5qj8-6xxj-hp9h19 Jul 2022

    Dompdf before v2.0.0 vulnerable to chroot check bypass

    Affected
    <2.0.0
    Fixed in
    2.0.0
  • MediumCVE-2022-0085GHSA-pf6p-25r2-fx4529 Jun 2022

    Server-Side Request Forgery in dompdf/dompdf

    Affected
    <2.0.0
    Fixed in
    2.0.0
  • CriticalCVE-2022-28368GHSA-x752-qjv4-c4hc4 Apr 2022

    Remote code injection in dompdf/dompdf

    Affected
    <1.2.1
    Fixed in
    1.2.1

Which of your client projects are still on dompdf/dompdf 0.8?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompdf/dompdf version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other dompdf/dompdf versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.