NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

CVE-2024-45801 — dompurify

HIGHFix: cure53/DOMPurify@1e52026

CVE-2024-45801 is a high-severity (CVSS 7.3) CWE-1333 vulnerability in dompurify. A fix is available for dompurify — see the affected versions and patch details below.

Tampering by prototype polution in DOMPurify

Also known asGHSA-mmhx-hmjr-r674
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 1, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-45801.

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs60th percentile — riskier than 60% of all scored CVEsHighest risk
0.00%0.46%0.93%1.39%0.1%0.9%May 26Aug 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

6Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
dompurifynpm
95.8Mdownloads / week

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmdompurifyall versions2.5.4npm install dompurify@2.5.4
📦npmdompurify≥ 3.0.0&&< 3.1.33.1.3npm install dompurify@3.1.3

Affected Products

1 product · 2 configurations
Application
dompurifycure53
≥ 3.0.0 && < 3.1.3
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dompurify, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dompurify to 2.5.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-45801 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

The vulnerability in DOMPurify, while significant, is categorized as moderate severity rather than important due to its specific conditions for exploitation. The issue requires not only a sophisticated nesting technique to bypass the depth checks but also the ability to leverage Prototype Pollution to weaken these…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for CVE-2024-45801 (CC BY 4.0)
ProductFixed inAdvisory
Cryostat 3 on RHEL 8cryostat-tech-preview/cryostat-db-rhel8:3.0.1-3RHSA-2024:7706
NETWORK-OBSERVABILITY-1.7.0-RHEL-9network-observability/network-observability-cli-rhel9:v1.7.0-67RHSA-2024:8014
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9rhacm2/acm-cluster-permission-rhel9:v2.11.4-4RHSA-2024:11381
Red Hat Ansible Automation Platform 2.4 for RHEL 8automation-controller-0:4.5.13-1.el8apRHSA-2024:10762
Red Hat OpenShift Container Platform 4.18openshift4/ose-monitoring-plugin-rhel9:v4.18.0-202504160308.p0.geb6123b.assembly.stream.el9RHSA-2025:4019
Red Hat OpenShift Dev Spaces 3 Containersdevspaces/code-rhel9:3.18-6RHSA-2025:0892
RHOL-5.9-RHEL-9openshift-logging/cluster-logging-operator-bundle:v5.9.7-11RHSA-2024:7324

Frequently Asked Questions

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
O3 Security · Impact-Aware SCA

Is CVE-2024-45801 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-45801: dompurify XSS — Fixed in 2.5.4