Is dompdf/dompdf 3.0 vulnerable?

Composer · 3 releases from 3.0.0 to 3.0.2 · latest dompdf/dompdf is 3.1.6 · checked 1 Nov 2026

Yes: 6 known advisories

Yes. dompdf/dompdf 3.0.2, the last 3.0 release, is affected by 6 known security advisories (4 medium, 2 low), including CVE-2026-59943, CVE-2026-59942, CVE-2026-59941. Upgrade to 3.1.6 or later to fix all of them.

Upgrade with:composer require dompdf/dompdf:^3.1.6

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting dompdf/dompdf 3.0.2

  • MediumCVE-2026-59943GHSA-j8qw-6jw8-r29722 Jul 2026

    Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59942GHSA-f5gf-2cj8-52g222 Jul 2026

    Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59941GHSA-8hg6-c449-896m22 Jul 2026

    Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-56722GHSA-cx96-42px-69fm22 Jul 2026

    Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55555GHSA-7x2p-4jvh-638422 Jul 2026

    Dompdf: File existence oracle via font-face stylesheet declaration

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55554GHSA-wvh6-f5jh-8gw422 Jul 2026

    Dompdf: Chroot Validation Bypass

    Affected
    <3.1.6
    Fixed in
    3.1.6

Which of your client projects are still on dompdf/dompdf 3.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompdf/dompdf version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other dompdf/dompdf versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.