Is dompdf/dompdf 3.1 vulnerable?

Composer · 7 releases from 3.1.0 to 3.1.6 · latest dompdf/dompdf is 3.1.6 · checked 1 Nov 2026

No known advisories in the last release

dompdf/dompdf 3.1.6, the last 3.1 release, has no known advisories. 6 advisories affect earlier 3.1.x releases, so update to 3.1.6.

Update within 3.1:composer require dompdf/dompdf:^3.1.6

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 3.1.x, affecting earlier releases

  • MediumCVE-2026-59943GHSA-j8qw-6jw8-r29722 Jul 2026

    Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59942GHSA-f5gf-2cj8-52g222 Jul 2026

    Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-59941GHSA-8hg6-c449-896m22 Jul 2026

    Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • MediumCVE-2026-56722GHSA-cx96-42px-69fm22 Jul 2026

    Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55555GHSA-7x2p-4jvh-638422 Jul 2026

    Dompdf: File existence oracle via font-face stylesheet declaration

    Affected
    <3.1.6
    Fixed in
    3.1.6
  • LowCVE-2026-55554GHSA-wvh6-f5jh-8gw422 Jul 2026

    Dompdf: Chroot Validation Bypass

    Affected
    <3.1.6
    Fixed in
    3.1.6

Which of your client projects are still on dompdf/dompdf 3.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompdf/dompdf version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other dompdf/dompdf versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.