purify-edge

purify-edge runs the unmodified DOMPurify on a small parse5-based DOM instead of jsdom. Output is byte-identical to DOMPurify on jsdom, it is about 65 KB gzipped, and it runs on Cloudflare Workers and other edge runtimes where jsdom cannot. Migrating from isomorphic-dompurify is a one-line import change.

How it works

1. 01

   About 800 lines of commented JavaScript implement the window and DOM that DOMPurify calls, with HTML parsing and serialization done by parse5.

2. 02

   DOMPurify runs on that window exactly as it would on jsdom, so the sanitizing rules are DOMPurify's own.

3. 03

   Parity with DOMPurify on jsdom is checked by the official suite, a differential fuzzer and parity corpora, all run in CI.

What it does

• The sanitizer is DOMPurify 3.4.16, pinned and unpatched, so every allow list, hook and config option carries over
• Passes DOMPurify's own official suite (984 tests, 1,247 assertions) with results identical to the jsdom run
• Runs in workerd (Cloudflare Workers) without the Node compatibility flag, in the Vercel edge isolate, and on Node 20 to 24
• Bundle is 218.5 KB minified, 65.6 KB gzipped, with parse5, DOMPurify and the DOM shim included
• Drop-in for isomorphic-dompurify: change one import line