Input Sanitization & Security Packages
Input sanitization, XSS prevention, and application-security utilities that clean untrusted input before it reaches your rendering or storage layer (DOMPurify).
Packages in Input Sanitization & Security
Kind
Sort:Used by Most Apps
DOMPurify
DOM-only, uber-tolerant XSS sanitizer for HTML, MathML, and SVG that runs in the browser and on the server.
cors
Node.js CORS middleware for Express and Connect that sets standards-compliant headers to control cross-origin browser access.
sanitize-html
Allowlist-based HTML sanitizer that strips XSS vectors from untrusted markup while preserving the tags and attributes you choose to keep.
rehype-sanitize
A unified rehype plugin that sanitizes HTML to prevent XSS by dropping anything a schema does not explicitly allow.
helmet
Secure Node and Express apps by setting protective HTTP response headers with a single line of middleware.
express-rate-limit
Basic IP rate-limiting middleware for Express to throttle repeated requests and protect public APIs and sensitive endpoints.
validator.js
A dependency-free library of 100+ string validators and sanitizers for Node.js and the browser.
isbot
Detect bots, crawlers, and spiders from the user agent string with a single call.
markupsafe
Escapes untrusted strings for safe use in HTML and XML markup, preventing injection attacks in templated output.
cors
A spec-compliant, configurable CORS middleware for Go's net/http, with drop-in compatibility for most Go web frameworks.
rate-limiter-flexible
Atomic and non-atomic counters and rate-limiting tools that protect against DoS and brute-force attacks at any scale
defusedxml
Drop-in replacements for Python's XML modules that block XML-bomb and entity-expansion attacks
html-entities
Fast, zero-dependency HTML5/HTML4/XML entity encoding and decoding for JavaScript and TypeScript.
@fastify/cors
Official Fastify plugin that adds configurable CORS headers and preflight handling to any Fastify API.
bluemonday
A fast, allowlist-based HTML sanitizer for Go that strips XSS vectors from untrusted content while preserving safe markup.
isolated-vm
Secure, isolated V8 JavaScript environments for Node.js
isomorphic-dompurify
Isomorphic wrapper for DOMPurify that sanitizes HTML identically on server and client.
shell-quote
Parses and quotes POSIX shell command strings, guarding against shell injection when building commands programmatically.
he
A robust, spec-compliant HTML entity encoder and decoder for JavaScript with full Unicode support.
react-turnstile
React bindings for Cloudflare Turnstile — a privacy-first CAPTCHA alternative with a declarative component and a full imperative ref API.
django-cors-headers
Configurable CORS headers middleware for Django applications
Bleach
Allowlist-based HTML sanitizing library for untrusted text
express-validator
A chainable Express middleware that wraps validator.js to validate and sanitize incoming request data with minimal boilerplate.
govalidator
A comprehensive Go package of string, numeric, and struct validators and sanitizers, modeled on validator.js.
