dompurify

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is written by security people who have vast background in web a

Latest 3.4.11

NPM

83%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

Attestations

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-36958 New dompurify is vulnerable to Improper Input Validation in versions 3.0.6 - 3.4.10.	3.0.6 - 3.4.10	Low
CVE-2026-49978 dompurify is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.4.6.	0.0.0 - 3.4.6	Medium
CVE-2026-49458 dompurify is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.4.5.	0.0.0 - 3.4.5	Medium
CVE-2026-49459 dompurify is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.4.5.	0.0.0 - 3.4.5	Medium
AIKIDO-2026-11156 dompurify is vulnerable to Cross-Site Scripting (XSS) in versions 3.0.0 - 3.4.7.	3.0.0 - 3.4.7	Low