# DOMPurify

DOM-based XSS sanitizer that cleans HTML, MathML and SVG markup in the browser or on Node.js.


Source: https://findsoftware.frbit.cloud/dompurify/
Last reviewed: 2026-11-04
Listed since: 2026-11-04

## Record

### Links

- home: https://cure53.de/purify
- repository: https://github.com/cure53/DOMPurify

### Identity

- status: active
- maintainer: Dr.-Ing. Mario Heiderich, Cure53
- maintainerType: individual
- parent: unknown
- firstRelease: 2014
- hqCountry: DE

### Kind

- category: library
- hosting: node
- language: javascript
- runtime: node
- runtimeMin: unknown
- basedOn: unknown

### Content

- contentStore: not applicable
- databases: not applicable
- adminUi: not applicable
- headlessApi: not applicable
- templating: not applicable
- i18n: not applicable

### Rendering and deploy

- runsAs: not applicable
- renderingModes: not applicable
- installMethod: unknown

### License

- licenseModel: open-source
- license: MPL-2.0, Apache-2.0

### Releases

- currentMajor: 3
- latestReleaseDate: 2026-10-12

### Adoption

- githubStargazers: 17503
- packagistDownloads: not applicable
- npmWeeklyDownloads: 95817333
- contributors: 125
- pluginCount: unknown
- packagistMonthlyDownloads: unknown
- ecosystemsMonthlyDownloads: unknown
- httpArchiveSites: unknown
- wordpressActiveInstalls: unknown
- dependentRepos: 56633
- dependentPackages: 1705

### Sources

- urls: https://cure53.de/purify (read 2026-11-04)
- urls: https://api.github.com/repos/cure53/DOMPurify (read 2026-11-04)
- maintainer: https://github.com/cure53/DOMPurify/blob/main/package.json (read 2026-11-04)
- hqCountry: https://cure53.de/impressum.php (read 2026-11-04)
- firstRelease: https://api.github.com/repos/cure53/DOMPurify/git/ref/tags/v0.3 (read 2026-11-04)
- category: https://github.com/cure53/DOMPurify/blob/main/README.md (read 2026-11-04)
- language: https://api.github.com/repos/cure53/DOMPurify (read 2026-11-04)
- runtime: https://github.com/cure53/DOMPurify/blob/main/README.md (read 2026-11-04)
- license: https://github.com/cure53/DOMPurify/blob/main/package.json (read 2026-11-04)
- license: https://github.com/cure53/DOMPurify/blob/main/package.json (read 2026-11-04)
- currentMajor: https://api.github.com/repos/cure53/DOMPurify/releases/latest (read 2026-11-04)
- latestReleaseDate: https://api.github.com/repos/cure53/DOMPurify/releases/latest (read 2026-11-04)
- githubStargazers: https://api.github.com/repos/cure53/DOMPurify (read 2026-11-04)
- contributors: https://api.github.com/repos/cure53/DOMPurify/contributors?per_page=1 (read 2026-11-04)
- npmWeeklyDownloads: https://api.npmjs.org/downloads/range/2026-10-26:2026-11-01/dompurify (read 2026-11-04)
- dependentPackages: https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/dompurify (read 2026-11-04)
- dependentRepos: https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/dompurify (read 2026-11-04)

## Notes

DOMPurify is a DOM-based sanitizer that removes unsafe content from HTML, MathML and SVG strings to prevent cross-site scripting. The [README](https://github.com/cure53/DOMPurify/blob/main/README.md) says DOMPurify is included on a website and runs in the browser, and that it also works server-side with Node.js, where a DOM such as jsdom has to be supplied.

## Worth knowing

The README says that server-side use depends on the DOM supplied, that happy-dom is not considered safe for it, and that legacy browsers such as MSIE get no sanitizing; security updates for MSIE come from an older branch.

---

Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attributes are recorded, never scored; absent means unknown.
Credit, in full: FindSoftware, CC BY 4.0