CVE catalog

CVE-2026-65902

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 22, 2026

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-dompurifysid3.4.16+dfsg-1fixed
Debiannode-dompurifyforky3.4.16+dfsg-1fixed
Debiannode-dompurifytrixie3.1.7+dfsg+~3.0.5-2vulnerable
Debiannode-dompurifybookworm2.4.1+dfsg+~2.4.0-2+deb12u1vulnerable
Debiannode-dompurifybookworm-security2.4.1+dfsg+~2.4.0-2vulnerable
Ubuntunode-dompurify22.042.3.0+dfsg-2vulnerable
Ubuntunode-dompurify22.042.3.3+dfsg-1vulnerable
Ubuntunode-dompurify24.042.4.1+dfsg+~2.4.0-1vulnerable
Ubuntunode-dompurify24.043.0.9+dfsg+~3.0.5-1vulnerable
Ubuntunode-dompurify26.043.1.7+dfsg+~3.0.5-2vulnerable
Ubuntunode-dompurify26.043.3.3+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-dompurifysourcesid3.4.12+dfsg-1not yet assignedNot reportedNot reported
Debiannode-dompurifysourceforky3.4.12+dfsg-1not yet assignedNot reportedNot reported
Debiannode-dompurifysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-dompurifysourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-dompurify]Affected
    Details (4)

    • 2.4.1+dfsg+~2.4.0-2+deb12u1 · all · bookworm

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2+deb12u1 · all · bookworm

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2 · all · bookworm-security

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

    • 2.4.1+dfsg+~2.4.0-2 · all · bookworm-security

      Affected

      nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

[Debian 13 (Trixie)]

  • [node-dompurify]Affected
    Details (2)

    • 3.1.7+dfsg+~3.0.5-2 · all · trixie

      Affected

      nvd · node-dompurify · debian · 13

    • 3.1.7+dfsg+~3.0.5-2 · all · trixie

      Affected

      nvd · node-dompurify · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]