Packages / Debian 12 (Bookworm) / javascript / node-dompurify

Package: node-dompurify (2.4.1+dfsg+~2.4.0-2+deb12u1)

DOM-only, super-fast, uber-tolerant XSS sanitizer

Download node-dompurify

Architecture	Package size	Installed size	Files	Package
all	69 KiB	706 KiB	list of files	Download

Percorsi file del pacchetto (0)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

No package-associated file paths were observed for the displayed build metadata.

Field source: Debian 12 (Bookworm) main amd64

Usa questo pacchetto

OpenFactory può avviare questo sistema operativo in una macchina virtuale del browser, o iniziare una costruzione che include il nome nativo del pacchetto di questo record.

Prova Debian 12 (Bookworm) nel browser Crea un'immagine che include node-dompurify

Versioni, suite e repository

Ogni riga è metadato dell'indice pacchetti per una versione, architettura, suite e repository. Nomi, URL e dimensioni arrivano dalla fonte; un link è un punto di recupero mutabile, non una redistribuzione OpenFactory.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
2.4.1+dfsg+~2.4.0-2+deb12u1	bookworm / main	all	Debian 12 · main · amd64	69 KiB	706 KiB	pool/main/n/node-dompurify/node-dompurify_2.4.1+dfsg+~2.4.0-2+deb12u1_all.deb
2.4.1+dfsg+~2.4.0-2+deb12u1	bookworm / main	all	Debian 12 · main · arm64	69 KiB	706 KiB	pool/main/n/node-dompurify/node-dompurify_2.4.1+dfsg+~2.4.0-2+deb12u1_all.deb

Field source: Debian 12 (Bookworm) main amd64

Vulnerabilità note

L’associazione dei pacchetti è in corso.

CVE	Gravità	Impatto per versione
[CVE-2026-109345] DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still	Medium(5.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm
[CVE-2026-109344] DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks.	Medium(5.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm
[CVE-2026-75838] DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event ha	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65901] DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects wi	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65898] DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers c	High(7.2)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65899] DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65900] DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65902] DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65903] DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tag	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65904] DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof	Medium(4.7)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65911] In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the s	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65912] DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65913] DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-65914] DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes,	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-66010] DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. A	Medium(5.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-49978] DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.co	High(8.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-49459] DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-co	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-49458] DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow	Medium(6.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-47423] DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitizatio	High(8.2)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12
[CVE-2026-41240] DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAG	High(8.1)	Interessata Dettagli (2) `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12 `2.4.1+dfsg+~2.4.0-2+deb12u1` · all · bookworm Interessata nvd · node-dompurify · debian · bookworm; nvd · node-dompurify · debian · 12

[Altri risultati]

Ultima sincronizzazione: Oct 23, 2026, 10:51:45 PM UTC

[Catalogo CVE]

Checksum

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

2.4.1+dfsg+~2.4.0-2+deb12u1 / allOsservato Sep 1, 2026sha256 e7710ebf8fea…e6847830Impronta della fonte

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Impronta della fonte (sha256): e7710ebf8feacbe11100ac2b5ece398c31bd922a2fe9a7b150dbaa6ce6847830

Verifica download

printf '%s  %s\n' 'e7710ebf8feacbe11100ac2b5ece398c31bd922a2fe9a7b150dbaa6ce6847830' 'node-dompurify_2.4.1+dfsg+~2.4.0-2+deb12u1_all.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main amd64

2.4.1+dfsg+~2.4.0-2+deb12u1 / allOsservato Sep 1, 2026sha256 e7710ebf8fea…e6847830Impronta della fonte

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Impronta della fonte (sha256): e7710ebf8feacbe11100ac2b5ece398c31bd922a2fe9a7b150dbaa6ce6847830

Verifica download

printf '%s  %s\n' 'e7710ebf8feacbe11100ac2b5ece398c31bd922a2fe9a7b150dbaa6ce6847830' 'node-dompurify_2.4.1+dfsg+~2.4.0-2+deb12u1_all.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) main arm64

Fonti

Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Observed SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Result
match verified
Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Observed SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Result
match verified
Debian 12 (Bookworm) security main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-security-main-amd64:f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/bookworm-security/InRelease
Signed-object SHA-256
6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
Signer fingerprint
ED541312A33F1128F10B1C6C54404762BBB6E853
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Observed SHA-256
f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Result
match verified
Debian 12 (Bookworm) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-security-main-arm64:f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/bookworm-security/InRelease
Signed-object SHA-256
6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
Signer fingerprint
ED541312A33F1128F10B1C6C54404762BBB6E853
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Observed SHA-256
f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Result
match verified