PatchTheCVEdompurify vulnerabilities and fixes
Recent CVEs affecting dompurify, with upgrade or downgrade steps. 12 tracked.
dompurify has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-07-24. Highest priority: CVE-2026-65898 (score 38/100).
- CVE-2026-65898 HIGH 7.2 UPGRADE DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitiz
- CVE-2026-65899 MEDIUM 6.1 UPGRADE DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so
- CVE-2026-65902 MEDIUM 6.1 UPGRADE DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOW
- CVE-2026-65911 MEDIUM 6.1 UPGRADE In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() pers
- CVE-2026-65900 MEDIUM 6.1 UPGRADE DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM outpu
- CVE-2026-65903 MEDIUM 6.1 UPGRADE DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows f
- CVE-2026-65914 MEDIUM 6.1 UPGRADE DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special pa
- CVE-2026-65901 MEDIUM 6.1 UPGRADE DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-co
- CVE-2026-66010 MEDIUM 6.1 UPGRADE DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELE
- CVE-2026-65912 MEDIUM 6.1 UPGRADE DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate
- CVE-2026-65913 MEDIUM 6.1 UPGRADE DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers
- CVE-2026-65904 MEDIUM 4.7 UPGRADE DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates fr
FAQ
How do I fix dompurify vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dompurify being exploited right now?
None of the tracked dompurify CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dompurify CVE should I patch first?
CVE-2026-65898 currently ranks highest (38/100): DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitiz.