Download Latest Version 3.4.2.tar.gz (348.8 kB)
Email in envelope

Get an email when there's a new version of DOMPurify

Home / 3.4.0
Name Modified Size InfoDownloads / Week
Parent folder
DOMPurify 3.4.0 source code.tar.gz 2026-04-14 419.2 kB
0
DOMPurify 3.4.0 source code.zip 2026-04-14 452.3 kB
0
README.md 2026-04-14 1.3 kB
0
Totals: 3 Items   872.9 kB 0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Source: README.md, updated 2026-04-14