Is dompurify 3.4 vulnerable?
npm · 18 releases from 3.4.0 to 3.4.17 · latest dompurify is 3.4.17 · checked 2 Nov 2026
No known advisories in the last release
dompurify 3.4.17, the last 3.4 release, has no known advisories. 16 advisories affect earlier 3.4.x releases, so update to 3.4.17.
npm install dompurify@3.4.17Fixed within 3.4.x, affecting earlier releases
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- Affected
- >=3.4.4 <3.4.17
- Fixed in
- 3.4.17
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
- Affected
- <3.4.17
- Fixed in
- 3.4.17
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- Affected
- <3.4.16
- Fixed in
- 3.4.16
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
- Affected
- >=3.4.13 <3.4.16
- Fixed in
- 3.4.16
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
- Affected
- <3.4.13
- Fixed in
- 3.4.13
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
- Affected
- <3.4.12
- Fixed in
- 3.4.12
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
- Affected
- <3.4.11
- Fixed in
- 3.4.11
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
- Affected
- <3.4.9
- Fixed in
- 3.4.9
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
- Affected
- >=3.0.0 <3.4.8
- Fixed in
- 3.4.8
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
- Affected
- <=3.4.6
- Fixed in
- No fix released
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
- Affected
- <3.4.7
- Fixed in
- 3.4.7
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- Affected
- <3.4.6
- Fixed in
- 3.4.6
DOMPurify XSS via selectedcontent re-clone
- Affected
- >=3.4.4 <3.4.5
- Fixed in
- 3.4.5
Which of your client projects are still on dompurify 3.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact dompurify version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other dompurify versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.