---
title: "Django 4.2.21 release notes"
version: 5.1
locale: en
source: https://docs.djangoproject.com/en/5.1/releases/4.2.21/
canonical: https://djangodocs.dev/en/5.1/releases/4.2.21/
---
# Django 4.2.21 release notes

*May 7, 2025*

Django 4.2.21 fixes a security issue with severity “moderate”, a data loss bug,
and a regression in 4.2.20.

This release was built using an upgraded [setuptools](https://pypi.org/project/setuptools/), producing
filenames compliant with [**PEP 491**](https://peps.python.org/pep-0491/) and [**PEP 625**](https://peps.python.org/pep-0625/) and thus addressing a PyPI
warning about non-compliant distribution filenames. This change only affects
the Django packaging process and does not impact Django’s behavior.

## CVE-2025-32873: Denial-of-service possibility in `strip_tags()`

[`strip_tags()`](/en/5.1/ref/utils/#django.utils.html.strip_tags) would be slow to evaluate certain inputs
containing large sequences of incomplete HTML tags. This function is used to
implement the [`striptags`](/en/5.1/ref/templates/builtins/#std-templatefilter-striptags) template filter, which was thus also
vulnerable.

[`strip_tags()`](/en/5.1/ref/utils/#django.utils.html.strip_tags) now raises a [`SuspiciousOperation`](/en/5.1/ref/exceptions/#django.core.exceptions.SuspiciousOperation)
exception if it encounters an unusually large number of unclosed opening tags.

## Bugfixes

- Fixed a data corruption possibility in `file_move_safe()` when
  `allow_overwrite=True`, where leftover content from a previously larger
  file could remain after overwriting with a smaller one due to lack of
  truncation ([#36298](https://code.djangoproject.com/ticket/36298)).
- Fixed a regression in Django 4.2.20, introduced when fixing
  [**CVE 2025-26699**](https://www.cve.org/CVERecord?id=CVE-2025-26699), where the [`wordwrap`](/en/5.1/ref/templates/builtins/#std-templatefilter-wordwrap) template filter did not
  preserve empty lines between paragraphs after wrapping text
  ([#36341](https://code.djangoproject.com/ticket/36341)).