npm dompurify

Name: npm dompurify
Brand: npm

productUS

pkg:npm/dompurify

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical0high17medium0low

updated 2026-10-28

vulnerabilities (35)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-48910US	critical9.8	1.15% (67th)	Exploit	2.4.2	2024-10-31	< 2.4.2
CVE-2024-47875US	medium6.1	1.13% (66th)	Exploit	3.1.3	2024-10-11	2 versions
CVE-2026-47423US	—	0.41% (35th)	Exploit	3.4.5	2026-07-14	3.4.4 → 3.4.5
CVE-2020-26870US	medium6.1	4.88% (92nd)	—	2.0.17	2020-10-07	< 2.0.17
CVE-2019-16728US	medium6.1	1.46% (73rd)	—	2.0.3	2019-09-24	< 2.0.3
CVE-2024-45801US	medium6.1	0.89% (59th)	—	2.5.4	2024-09-16	2 versions
CVE-2025-26791US	medium6.1	0.60% (49th)	—	3.2.4	2025-02-14	< 3.2.4
CVE-2019-25155US	medium6.1	0.51% (43rd)	—	1.0.11	2023-11-07	< 1.0.11
CVE-2026-65899US	—	0.41% (35th)	—	3.4.9	2026-07-23	< 3.4.9
CVE-2026-49978US	medium6.1	0.40% (35th)	—	3.4.7	2026-07-14	< 3.4.7
CVE-2026-49458US	—	0.40% (35th)	—	3.4.6	2026-07-14	< 3.4.6
CVE-2026-75838US	—	0.39% (33rd)	—	3.4.13	2026-08-18	< 3.4.13
CVE-2026-49459US	—	0.36% (30th)	—	3.4.6	2026-07-14	< 3.4.6
CVE-2026-65902US	medium6.1	0.36% (29th)	—	3.4.7	2026-07-23	< 3.4.7
CVE-2026-0540US	—	0.35% (29th)	—	2.5.9	2026-03-03	2 versions
CVE-2026-65903US	—	0.33% (25th)	—	3.4.0	2026-07-23	< 3.4.0
CVE-2026-65913US	medium6.1	0.32% (25th)	—	3.3.2	2026-07-23	< 3.3.2
CVE-2026-41240US	medium6.1	0.31% (24th)	—	3.4.0	2026-04-23	< 3.4.0
CVE-2026-65900US	—	0.31% (24th)	—	3.4.8	2026-07-23	3.0.0 → 3.4.8
CVE-2026-65914US	medium6.1	0.31% (23rd)	—	3.3.2	2026-07-23	< 3.3.2
CVE-2026-65912US	—	0.30% (23rd)	—	3.3.2	2026-07-23	< 3.3.2
CVE-2026-65901US	medium6.1	0.29% (21st)	—	no fix	2026-07-23	≤ 3.4.6
CVE-2026-41238US	—	0.27% (19th)	—	3.4.0	2026-04-23	3.0.1 → 3.4.0
CVE-2025-15599US	—	0.26% (17th)	—	3.2.7	2026-03-03	2 versions
CVE-2026-109345US	medium6.1	0.25% (16th)	—	3.4.16	2026-10-12	< 3.4.16
CVE-2026-41239US	—	0.25% (16th)	—	3.4.0	2026-04-23	1.0.10 → 3.4.0
CVE-2026-116802US	medium6.1	0.22% (12th)	—	3.4.17	2026-10-27	< 3.4.17
CVE-2026-66010US	—	0.21% (12th)	—	3.4.12	2026-07-24	< 3.4.12
CVE-2026-65898US	—	0.21% (12th)	—	3.4.11	2026-07-23	< 3.4.11
CVE-2026-109344US	medium6.1	0.19% (8th)	—	3.4.16	2026-10-12	3.4.13 → 3.4.16
CVE-2026-116804US	medium6.1	0.18% (7th)	—	3.4.17	2026-10-27	3.4.4 → 3.4.17
CVE-2026-116803US	medium6.1	0.16% (6th)	—	3.4.17	2026-10-27	< 3.4.17

showing 32 of 35

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')25 CVEs
CWE-693Protection Mechanism Failure6 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')5 CVEs
CWE-183Permissive List of Allowed Inputs2 CVEs
CWE-501Trust Boundary Violation2 CVEs
CWE-1289Improper Validation of Unsafe Equivalence in Input1 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-184Incomplete List of Disallowed Inputs1 CVEs

sources (1)

Which sources assert this record, and when.

USOSV.dev32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan