DOMPurify
DOM-based XSS sanitizer that cleans HTML, MathML and SVG markup in the browser or on Node.js.
DOMPurify is a DOM-based sanitizer that removes unsafe content from HTML, MathML and SVG strings to prevent cross-site scripting. The README says DOMPurify is included on a website and runs in the browser, and that it also works server-side with Node.js, where a DOM such as jsdom has to be supplied.
Worth knowing
The README says that server-side use depends on the DOM supplied, that happy-dom is not considered safe for it, and that legacy browsers such as MSIE get no sanitizing; security updates for MSIE come from an older branch.
Identity
- Status
- Active
- Maintainer
- Dr.-Ing. Mario Heiderich, Cure533
- Maintained by
- Individual
- First release
- 20145
- Headquarters
- Germany4
Releases
Adoption
Sources
- 2026-11-04: links
cure53.de/purify - 2026-11-04: links, Written in, GitHub stars
api.github.com/repos/cure53/DOMPurify - 2026-11-04: Maintainer, License
github.com/cure53/DOMPurify/blob/main/package.json - 2026-11-04: Headquarters
cure53.de/impressum.php - 2026-11-04: First release
api.github.com/repos/cure53/DOMPurify/git/ref/tags/v0.3 - 2026-11-04: Categories, Runtime
github.com/cure53/DOMPurify/blob/main/README.md - 2026-11-04: Current major version, Last release
api.github.com/repos/cure53/DOMPurify/releases/latest - 2026-11-04: Contributors
api.github.com/repos/cure53/DOMPurify/contributors?per_page=1 - 2026-11-04: npm downloads a week
api.npmjs.org/downloads/range/2026-10-26:2026-11-01/dompurify - 2026-11-04: Dependent packages, Dependent repositories
packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/dompurify