Vulnerabilities in old jQuery versions
Security scans and PCI audits still flag old jQuery in web applications, and jQuery 1.x and 2.x get no more fixes. These are the versions found most often, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentOld jQuery versions
| jQuery | Notes | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|
| 1.7.1 | 5 | 0 | 1 | Patch on order, 48 h | |
| 1.8.3 | 5 | 0 | 1 | Patch on order, 48 h | |
| 1.9.1 | 3 | 0 | 1 | Patch on order, 48 h | |
| 1.11.1 | 3 | 0 | 1 | Patch on order, 48 h | |
| 1.12.4 | Last jQuery 1.x release, bundled with WordPress up to 5.5 | 4 | 0 | 1 | Patch on order, 48 h |
| 2.2.4 | Last jQuery 2.x release | 4 | 0 | 1 | Patch on order, 48 h |
| 3.4.1 | 2 | 0 | 1 | Patch on order, 48 h |
Vulnerabilities from the OSV open-source vulnerability database, 28 October 2026, for the upstream version, counting only entries where jQuery itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
JavaScript libraries
Old jQuery, AngularJS and Vue 2: the versions security scans still find, and what affects them. All JavaScript libraries
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans