Is dompdf/dompdf 2.0 vulnerable?

Composer · 8 releases from 2.0.0 to 2.0.8 · latest dompdf/dompdf is 3.1.6 · checked 1 Nov 2026

Yes: 6 known advisories

Yes. dompdf/dompdf 2.0.8, the last 2.0 release, is affected by 6 known security advisories (4 medium, 2 low), including CVE-2026-59943, CVE-2026-59942, CVE-2026-59941. 4 more affect earlier 2.0.x releases. Upgrade to 3.1.6 or later to fix all of them.

Upgrade with:composer require dompdf/dompdf:^3.1.6

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting dompdf/dompdf 2.0.8

  • MediumCVE-2026-59943GHSA-j8qw-6jw8-r29722 Jul 2026

    Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59942GHSA-f5gf-2cj8-52g222 Jul 2026

    Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59941GHSA-8hg6-c449-896m22 Jul 2026

    Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-56722GHSA-cx96-42px-69fm22 Jul 2026

    Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55555GHSA-7x2p-4jvh-638422 Jul 2026

    Dompdf: File existence oracle via font-face stylesheet declaration

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55554GHSA-wvh6-f5jh-8gw422 Jul 2026

    Dompdf: Chroot Validation Bypass

    Affected
    <3.1.6
    Fixed in
    3.1.6

Fixed within 2.0.x, affecting earlier releases

  • MediumCVE-2023-50262GHSA-3qx2-6f78-w2j213 Dec 2023

    Denial of service caused by infinite recursion when parsing SVG images

    Affected
    <2.0.4
    Fixed in
    2.0.4
  • CriticalCVE-2023-24813GHSA-56gj-mvh6-rp757 Feb 2023

    URI validation failure on SVG parsing. Bypass of CVE-2023-23924

    Affected
    >=2.0.2 <2.0.3
    Fixed in
    2.0.3
  • CriticalCVE-2023-23924GHSA-3cw5-7cxw-v5qg1 Feb 2023

    Dompdf vulnerable to URI validation failure on SVG parsing

    Affected
    <2.0.2
    Fixed in
    2.0.2
  • HighCVE-2022-41343GHSA-6x28-7h8c-chx426 Sept 2022

    Dompdf allows remote file inclusion because URI validation failure does not halt font registration

    Affected
    <2.0.1
    Fixed in
    2.0.1

Which of your client projects are still on dompdf/dompdf 2.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompdf/dompdf version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other dompdf/dompdf versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.