VulertSecurity VulertSecurity

Vulnerability Database · Debian · node-dompurify · Version

node-dompurify 2.4.1 dfsg ~2.4.0-2

2.4.1 dfsg ~2.4.0-2 is affected by 29 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 0 High 1 Medium 4 Low 0 Unrated 24

All node-dompurify versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

node-dompurify 2.4.1 dfsg ~2.4.0-2 vulnerabilities

29 vulnerabilities cover node-dompurify 2.4.1 dfsg ~2.4.0-2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Critical XSS Vulnerability in node-dompurify: DOMPurify 3.4.4 Allows Re-cloning of XSS Payloads 8.2 high No fix published 14 Jul 2026
Cross-Site Scripting Vulnerability in node-dompurify: Bypass of Sanitization 6.1 medium No fix published 12 Oct 2026
Cross-Site Scripting Vulnerability in node-dompurify: IN_PLACE Mode Flaw 6.1 medium No fix published 12 Oct 2026
DOMPurify Event-Handler Attribute Vulnerability in node-dompurify: CVE-2026-49459 6.1 medium No fix published 14 Jul 2026
DOMPurify Vulnerability in node-dompurify: Cross-Site Scripting Risk 6.1 medium No fix published 14 Jul 2026
Cross-Site Scripting Vulnerability in node-dompurify: IN_PLACE Sanitization Flaw N/A unrated No fix published 18 Aug 2026
Critical Vulnerability in node-dompurify: Bypass of Security Policies via Custom Elements N/A unrated No fix published 24 Jul 2026
Cross-Site Scripting Vulnerability in node-dompurify: Persistent Function Predicates N/A unrated No fix published 23 Jul 2026
Critical XSS Vulnerability in node-dompurify: Insecure Allowlist Mutation N/A unrated No fix published 23 Jul 2026
Prototype Pollution Vulnerability in node-dompurify: Bypass Attribute Filtering N/A unrated No fix published 23 Jul 2026
Critical Vulnerability in node-dompurify: Bypass of Template Expression Sanitization N/A unrated No fix published 23 Jul 2026
Cross-Site Scripting Vulnerability in node-dompurify: CVE-2026-65901 N/A unrated No fix published 23 Jul 2026
DOMPurify Vulnerability in node-dompurify: Insecure Handling of Allowed Tags and Attributes N/A unrated No fix published 23 Jul 2026
Mutation-XSS Vulnerability in node-dompurify: Critical Security Flaw N/A unrated No fix published 23 Jul 2026
URI Validation Bypass Vulnerability in node-dompurify: CVE-2026-65912 N/A unrated No fix published 23 Jul 2026
Cross-Realm XSS Vulnerability in node-dompurify: Incomplete Sanitization of DOM Elements N/A unrated No fix published 23 Jul 2026
Critical Logic Error in node-dompurify Allows Bypass of FORBID_TAGS Restrictions N/A unrated No fix published 23 Jul 2026
DOMPurify Trusted Types Policy Retention Vulnerability in node-dompurify N/A unrated No fix published 23 Jul 2026
Critical DOMPurify Vulnerability in node-dompurify: IN_PLACE Sanitization Flaw N/A unrated No fix published 14 Jul 2026
Critical Vulnerability in node-dompurify: CVE-2026-41239 Exposes Applications to Security Risks N/A unrated No fix published 23 Apr 2026
Critical Vulnerability in node-dompurify: CVE-2026-41240 N/A unrated No fix published 23 Apr 2026
Critical Vulnerability in node-dompurify: CVE-2026-41238 N/A unrated No fix published 23 Apr 2026
Cross-Site Scripting Vulnerability in node-dompurify: DOMPurify Versions 3.1.3 to 3.3.1 and 2.5.3 to 2.5.8 N/A unrated No fix published 03 Mar 2026
Cross-Site Scripting Vulnerability in node-dompurify: Bypass of Attribute Sanitization N/A unrated No fix published 03 Mar 2026
Path Traversal Vulnerability in node-dompurify: Uncontrolled Data in Development Helper Script N/A unrated No fix published 15 May 2025
Path Traversal Vulnerability in node-dompurify: Insecure Pathname Handling N/A unrated No fix published 15 May 2025
Critical mXSS Vulnerability in node-dompurify: A Template Literal Regex Flaw N/A unrated No fix published 14 Feb 2025
Critical XSS Vulnerability in DOMPurify: Bypass of Depth Check N/A unrated 2.4.1+dfsg+~2.4.0-2+deb12u1 16 Sep 2024
Critical XSS Vulnerability in DOMPurify Package (node-dompurify) N/A unrated 2.4.1+dfsg+~2.4.0-2+deb12u1 16 Sep 2024

Looking for another version, or everything Vulert holds for node-dompurify?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About node-dompurify 2.4.1 dfsg ~2.4.0-2

Is node-dompurify 2.4.1 dfsg ~2.4.0-2 vulnerable?

Yes. 29 vulnerabilities in the Vulert database cover node-dompurify 2.4.1 dfsg ~2.4.0-2: 0 critical, 1 high, 4 medium and 0 low, plus 24 not yet rated. Each entry above names the fixed version to move to.

How do I monitor node-dompurify for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the node-dompurify version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.