Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

Fix availableCritical · CVSS 9.2

Published Oct 22, 2026 · updated Oct 22, 2026

What to do

  1. Upgrade to a fixed version: dompurify 3.4.17.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmdompurify

Vulnerable versions
>= 3.4.4, <= 3.4.16
Fixed in
3.4.17

Check your project: npm ls dompurify --all

Is dompurify@3.4.17 safe to install? See the upgrade verdict →

What changed

  1. Oct 22, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

← All critical vulnerabilities