CVE catalog

CVE-2026-65900

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 22, 2026

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-dompurifysid3.4.16+dfsg-1fixed
Debiannode-dompurifyforky3.4.16+dfsg-1fixed
Debiannode-dompurifytrixie3.1.7+dfsg+~3.0.5-2vulnerable
Debiannode-dompurifybookworm2.4.1+dfsg+~2.4.0-2+deb12u1vulnerable
Debiannode-dompurifybookworm-security2.4.1+dfsg+~2.4.0-2vulnerable
Ubuntunode-dompurify22.042.3.0+dfsg-2vulnerable
Ubuntunode-dompurify22.042.3.3+dfsg-1vulnerable
Ubuntunode-dompurify24.042.4.1+dfsg+~2.4.0-1vulnerable
Ubuntunode-dompurify24.043.0.9+dfsg+~3.0.5-1vulnerable
Ubuntunode-dompurify26.043.1.7+dfsg+~3.0.5-2vulnerable
Ubuntunode-dompurify26.043.3.3+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-dompurifysourcesid3.4.12+dfsg-1not yet assignedNot reportedNot reported
Debiannode-dompurifysourceforky3.4.12+dfsg-1not yet assignedNot reportedNot reported
Debiannode-dompurifysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-dompurifysourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-dompurify]Affected
    Details (4)

    • 2.4.1+dfsg+~2.4.0-2+deb12u1 · all · bookworm

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2+deb12u1 · all · bookworm

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2 · all · bookworm-security

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2 · all · bookworm-security

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

[Debian 13 (Trixie)]

  • [node-dompurify]Affected
    Details (2)

    • 3.1.7+dfsg+~3.0.5-2 · all · trixie

      Affected

      nvd · node-dompurify · debian · 13

    • 3.1.7+dfsg+~3.0.5-2 · all · trixie

      Affected

      nvd · node-dompurify · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]