Patchfirst
Patchfirst
Chaincure53 · DOMPurifynpm:dompurify

cure53 DOMPurify: successive fixes (2020–2026)

6 CVEs over 6 generations, 7 Oct 2020 to 3 Mar 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2020-268707 Oct 2020 First in the chain
  2. CVE-2024-4580116 Sep 2024 related to CVE-2020-26870
  3. CVE-2024-4787511 Oct 2024 related to CVE-2020-26870related to CVE-2024-45801
  4. CVE-2025-2679114 Feb 2025 related to CVE-2024-47875related to CVE-2020-26870and 1 more
  5. CVE-2025-155993 Mar 2026 related to CVE-2025-26791related to CVE-2020-26870and 2 more
  6. CVE-2026-05403 Mar 2026 related to CVE-2024-45801related to CVE-2020-26870and 3 more
202020222023202420252026 CVE-2024-45801 → CVE-2026-0540: related (high confidence)CVE-2024-47875 → CVE-2025-26791: related (high confidence)CVE-2025-26791 → CVE-2025-15599: related (high confidence)CVE-2020-26870 → CVE-2024-45801: related (medium confidence)CVE-2020-26870 → CVE-2024-47875: related (medium confidence)CVE-2020-26870 → CVE-2025-15599: related (medium confidence)CVE-2020-26870 → CVE-2025-26791: related (medium confidence)CVE-2020-26870 → CVE-2026-0540: related (medium confidence)CVE-2024-45801 → CVE-2024-47875: related (medium confidence)CVE-2024-45801 → CVE-2025-15599: related (medium confidence)CVE-2024-45801 → CVE-2025-26791: related (medium confidence)CVE-2024-47875 → CVE-2025-15599: related (medium confidence)CVE-2024-47875 → CVE-2026-0540: related (medium confidence)CVE-2025-26791 → CVE-2026-0540: related (medium confidence)CVE-2025-15599 → CVE-2026-0540: related (medium confidence) CVE-2020-26870 7 Oct 2020 CVE-2024-45801 16 Sep 2024 CVE-2024-47875 11 Oct 2024 CVE-2025-26791 14 Feb 2025 CVE-2025-15599 3 Mar 2026 CVE-2026-0540 3 Mar 2026 202020222023202420252026 CVE-2024-45801 → CVE-2026-0540: related (high confidence)CVE-2024-47875 → CVE-2025-26791: related (high confidence)CVE-2025-26791 → CVE-2025-15599: related (high confidence)CVE-2020-26870 → CVE-2024-45801: related (medium confidence)CVE-2020-26870 → CVE-2024-47875: related (medium confidence)CVE-2020-26870 → CVE-2025-15599: related (medium confidence)CVE-2020-26870 → CVE-2025-26791: related (medium confidence)CVE-2020-26870 → CVE-2026-0540: related (medium confidence)CVE-2024-45801 → CVE-2024-47875: related (medium confidence)CVE-2024-45801 → CVE-2025-15599: related (medium confidence)CVE-2024-45801 → CVE-2025-26791: related (medium confidence)CVE-2024-47875 → CVE-2025-15599: related (medium confidence)CVE-2024-47875 → CVE-2026-0540: related (medium confidence)CVE-2025-26791 → CVE-2026-0540: related (medium confidence)CVE-2025-15599 → CVE-2026-0540: related (medium confidence) CVE-2020-26870 7 Oct 2020 CVE-2024-45801 16 Sep 2024 CVE-2024-47875 11 Oct 2024 CVE-2025-26791 14 Feb 2025 CVE-2025-15599 3 Mar 2026 CVE-2026-0540 3 Mar 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2020-26870 7 Oct 2020 Cure53 DOMPurify before 2.0.17 allows mutation XSS · fixed in 2.0.17 First in chain 18.4
CVE-2024-45801 16 Sep 2024 Tampering by prototype polution in DOMPurify · fixed in 3.1.3 CVE-2020-26870 · related · Medium 17.0
CVE-2024-47875 11 Oct 2024 DOMPurify nesting-based mXSS · fixed in 3.1.3 CVE-2020-26870 · related · Medium 25.3
CVE-2025-26791 14 Feb 2025 DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site… · fixed in 3.2.4 CVE-2024-47875 · related · High 12.9
CVE-2025-15599 3 Mar 2026 DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML · fixed in 3.2.7 CVE-2025-26791 · related · High 8.6
CVE-2026-0540 3 Mar 2026 DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML · fixed in 3.3.2 CVE-2024-45801 · related · High 10.9
↑ ↓ chooseEnter openEsc close