CVE-2016-10707: Denial of Service in jquery
Summary
CVE-2016-10707: Denial of Service in jquery. Affects jquery versions >= 3.0.0-rc.1, < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jquery package is a popular JavaScript library that simplifies HTML document traversal, event handling, and animation. It is widely used in web development to enhance user experience and streamline front-end development. However, versions of jquery prior to 3.0.0 are vulnerable to a Denial of Service (DoS) attack. This vulnerability arises from a lowercasing logic used on attribute names. When a boolean attribute with uppercase characters is encountered, jquery enters into an infinite recursion loop, causing the call stack to exceed its limit and resulting in a DoS condition.
Vulnerability Detail
The vulnerability in jquery allows an attacker to exploit the lowercasing logic on attribute names, leading to an infinite recursion loop. By providing a boolean attribute with uppercase characters, the attacker can trigger this vulnerability and cause the application to become unresponsive or crash. This can lead to a denial of service condition, impacting the availability of the affected application. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
npm install jquery@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
npm install jquery@3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Updating to the fixed version of jquery is the recommended solution.
Conclusion
The jquery package is vulnerable to a Denial of Service (DoS) attack due to a lowercasing logic issue on attribute names. This vulnerability can be mitigated by updating to version 3.0.0 or later. It is crucial for developers to promptly update their dependencies to ensure the security and availability of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery →
FAQ
This vulnerability can lead to a denial of service condition, causing the affected application to become unresponsive or crash.
Versions of jquery prior to 3.0.0 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, updating the jquery package to version 3.0.0 or later will fix this vulnerability.
There are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery.
