CVE catalog
CVE-2026-116804
node-dompurify: CVE-2026-116804
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 27, 2026
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-dompurify | sid | 3.4.17+dfsg-1 | fixed |
| Debian | node-dompurify | forky | 3.4.16+dfsg-1 | vulnerable |
| Debian | node-dompurify | trixie | 3.1.7+dfsg+~3.0.5-2 | not affected |
| Debian | node-dompurify | bookworm | 2.4.1+dfsg+~2.4.0-2+deb12u1 | not affected |
| Debian | node-dompurify | bookworm-security | 2.4.1+dfsg+~2.4.0-2 | not affected |
| Ubuntu | node-dompurify | 22.04 | 2.3.0+dfsg-2 | vulnerable |
| Ubuntu | node-dompurify | 22.04 | 2.3.3+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 24.04 | 2.4.1+dfsg+~2.4.0-1 | vulnerable |
| Ubuntu | node-dompurify | 24.04 | 3.0.9+dfsg+~3.0.5-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.3.3+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.4.2+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.4.5+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.4.12+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.4.13+dfsg-1 | vulnerable |
| Ubuntu | node-dompurify | 26.10 | 3.4.13+dfsg-2 | vulnerable |
| Ubuntu | node-dompurify | 26.04 | 3.1.7+dfsg+~3.0.5-2 | vulnerable |
| Ubuntu | node-dompurify | 26.04 | 3.3.3+dfsg-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-dompurify | source | sid | 3.4.17+dfsg-1 | not yet assigned | Not reported | [1152298] |
| Debian | node-dompurify | source | forky | (unfixed) | not yet assigned | Not reported | [1152298] |
| Debian | node-dompurify | source | trixie | Not affected | unimportant | Not reported | [1152298] |
| Debian | node-dompurify | source | bookworm | Not affected | unimportant | Not reported | [1152298] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-dompurify]Not affected
Details (4)
2.4.1+dfsg+~2.4.0-2+deb12u1· all · bookwormNot affected
dsa · node-dompurify · debian · bookworm
2.4.1+dfsg+~2.4.0-2+deb12u1· all · bookwormNot affected
dsa · node-dompurify · debian · bookworm
2.4.1+dfsg+~2.4.0-2· all · bookworm-securityNot affected
dsa · node-dompurify · debian · bookworm
2.4.1+dfsg+~2.4.0-2· all · bookworm-securityNot affected
dsa · node-dompurify · debian · bookworm
Observed: