https://cybertoolchain.io/tools/dompurify New releases and features in DOMPurify, tracked by The Cyber Toolchain. en Sun, 06 Sep 2026 11:36:46 GMT https://github.com/cure53/DOMPurify/releases/tag/3.4.15 https://github.com/cure53/DOMPurify/releases/tag/3.4.15 Sun, 06 Sep 2026 11:36:46 GMT DOMPurify 3.4.15 hardens clobbering defenses for XML content and tightens several sanitization edge cases. • Adds stronger DOM-clobbering hardening specifically for XML content parsing paths. • Adds several smaller hardening improvements and edge-case fixes to the sanitization engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.4.14 https://github.com/cure53/DOMPurify/releases/tag/3.4.14 Wed, 19 Aug 2026 10:18:49 GMT DOMPurify 3.4.14 expands its SVG allow-list with `pointer-events` and `vector-effect` presentation attributes. • Adds SVG `pointer-events` and `vector-effect` presentation attributes to the built-in allow-list, enabling their use in sanitized SVG content without custom configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.4.12 https://github.com/cure53/DOMPurify/releases/tag/3.4.12 Sat, 11 Jul 2026 12:02:43 GMT DOMPurify 3.4.12 adds support for new SVG attributes alongside hardened handling of declarative partial updates. • Supports additional SVG attributes, expanding the set of valid SVG markup that passes through sanitization. • Strengthens handling of declarative partial updates to reduce exposure from incremental DOM mutation patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.3.0 https://github.com/cure53/DOMPurify/releases/tag/3.3.0 Mon, 13 Oct 2025 16:02:29 GMT DOMPurify 3.3.0 lets ADD_ATTR and ADD_TAGS accept functions for dynamic allow-list control. • Adds support for `ADD_ATTR` and `ADD_TAGS` to accept functions, enabling dynamic, context-aware allow-listing of attributes and tags. • Adds the SVG `mask-type` attribute to the default allow-list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.2.7 https://github.com/cure53/DOMPurify/releases/tag/3.2.7 Wed, 17 Sep 2025 11:47:30 GMT DOMPurify 3.2.7 adds tagName context to custom attribute checks and hardens CDATA/animated-href handling. • Adds new attributes and elements to the default allow-list. • Adds `tagName` parameter to the custom element `attributeNameCheck` callback, enabling per-tag attribute filtering logic. • Improves detection of animated `href` attributes to catch additional risky patterns. • Improves handling of potentially risky content inside CDATA elements. • Expands the raw-text element regular expression to cover `<textarea>` elements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.2.6 https://github.com/cure53/DOMPurify/releases/tag/3.2.6 Mon, 19 May 2025 15:21:58 GMT DOMPurify 3.2.6 adds matrix: URI support, stronger prototype-pollution hardening, and configurable mXSS scrubbing. • Supports `matrix:` as an allowed URI scheme for sanitizing Matrix protocol links. • Adds config hardening to defend against prototype pollution attacks on the sanitizer configuration. • Adds configuration options for aggressive mXSS scrubbing behavior. • Improves handling of attribute removal during sanitization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.2.4 https://github.com/cure53/DOMPurify/releases/tag/3.2.4 Thu, 30 Jan 2025 09:34:26 GMT DOMPurify 3.2.4 adds targeted hook removal and broader module exports. • Enables removal of specific hooks individually, rather than clearing all hooks at once. • Adds `purify.js` and `purify.min.js` to package exports for easier direct imports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.1.7 https://github.com/cure53/DOMPurify/releases/tag/3.1.7 Thu, 26 Sep 2024 11:11:52 GMT DOMPurify 3.1.7 adds Angular compiler support and expands HTML/SVG attribute allow-lists. • Adds improved support for the Angular compiler. • Expands the HTML and SVG attribute allow-lists with several new attributes. Breaking changes: • The `foreignObject` element has been removed from the list of HTML entry-points, which may affect sanitization behavior for configs that relied on it as an entry-point. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.1.0 https://github.com/cure53/DOMPurify/releases/tag/3.1.0 Sun, 07 Apr 2024 14:10:05 GMT DOMPurify 3.1.0 adds `SAFE_FOR_XML` setting for comment scrubbing control. • Added new setting `SAFE_FOR_XML` to enable better control over comment scrubbing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.0.2 https://github.com/cure53/DOMPurify/releases/tag/3.0.2 Fri, 14 Apr 2023 17:02:57 GMT DOMPurify 3.0.2 adds `mprescripts` tag support to MathML and SMS URI scheme to allowed list • Adds `mprescripts` element to the allowed MathML elements list for sanitization • Adds `sms:` URI scheme to the allowed URI schemes list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/3.0.0 https://github.com/cure53/DOMPurify/releases/tag/3.0.0 Mon, 13 Feb 2023 16:45:57 GMT DOMPurify 3.0 adds `ALLOW_SELF_CLOSE_IN_ATTR` flag and improves `shadowrootmode` support while dropping IE legacy code. • Adds the `ALLOW_SELF_CLOSE_IN_ATTR` configuration option to allow self-closing tags inside attributes. • Adds better support for the `shadowrootmode` option. • Removes all MSIE-specific code and tests, reducing bundle size. Breaking changes: • MSIE support is removed; use version 2.4.4 if Internet Explorer compatibility is required. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/2.4.1 https://github.com/cure53/DOMPurify/releases/tag/2.4.1 Thu, 10 Nov 2022 14:01:10 GMT DOMPurify 2.4.1 adds `ALLOWED_NAMESPACES` config option for XML handling and improves template literal detection. • Improves detection of template literals when `SAFE_FOR_TEMPLATES` is enabled Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/2.3.11 https://github.com/cure53/DOMPurify/releases/tag/2.3.11 Tue, 23 Aug 2022 09:20:39 GMT DOMPurify 2.3.11 adds `SANITIZE_NAMED_PROPS` config option for attribute handling • `SANITIZE_NAMED_PROPS` config option to control how named properties are sanitized. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify https://github.com/cure53/DOMPurify/releases/tag/2.3.4 https://github.com/cure53/DOMPurify/releases/tag/2.3.4 Tue, 07 Dec 2021 14:31:37 GMT Adds Custom Elements support with new `ALLOWED_CUSTOM_ELEMENTS` and `CUSTOM_ELEMENT_HANDLING` config keys • `ALLOWED_CUSTOM_ELEMENTS`: array of allowed custom element tag names for dompurify.sanitize(). • `CUSTOM_ELEMENT_HANDLING`: string ('ALLOW' or 'DISALLOW') to control whether custom elements are preserved or removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dompurify