*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2026-49978
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Publish Date: 2026-07-14
URL: CVE-2026-49978
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@ca30f07
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.7
CVE-2026-46625
Vulnerable Library - js-cookie-2.2.1.tgz
A simple, lightweight JavaScript API for handling cookies
Library home page: https://registry.npmjs.org/js-cookie/-/js-cookie-2.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/js-cookie-npm-2.2.1-e879cd2148-4387f5f569.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- ❌ js-cookie-2.2.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.proto setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-06-10
URL: CVE-2026-46625
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qjx8-664m-686j
Release Date: 2026-05-23
Fix Resolution: js-cookie - 3.0.7,https://github.com/js-cookie/js-cookie.git - v3.0.7
CVE-2026-2229
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- jsdom-28.0.0.tgz
- ❌ undici-7.21.0.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.
The vulnerability exists because:
- The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
- The createInflateRaw() call is not wrapped in a try-catch block
- The resulting exception propagates up through the call stack and crashes the Node.js process
Publish Date: 2026-03-12
URL: CVE-2026-2229
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-v9p9-hfj2-hcw8
Release Date: 2026-03-12
Fix Resolution: undici - 6.24.0,undici - 7.24.0
CVE-2026-1526
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- jsdom-28.0.0.tgz
- ❌ undici-7.21.0.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.
The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
Publish Date: 2026-03-12
URL: CVE-2026-1526
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-vrm6-8vpv-qv8q
Release Date: 2026-03-12
Fix Resolution: undici - 7.24.0,undici - 6.24.0
CVE-2026-12151
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- jsdom-28.0.0.tgz
- ❌ undici-7.21.0.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:
No workaround is available. The fix must be applied through an upgrade.
Publish Date: 2026-06-17
URL: CVE-2026-12151
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-vxpw-j846-p89q
Release Date: 2026-06-17
Fix Resolution: undici - 8.5.0,undici - 6.27.0,undici - 7.28.0,https://github.com/nodejs/undici.git - v7.28.0,https://github.com/nodejs/undici.git - v6.27.0,https://github.com/nodejs/undici.git - v8.5.0
CVE-2026-13697
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- jsdom-28.0.0.tgz
- ❌ undici-7.21.0.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
Publish Date: 2026-07-29
URL: CVE-2026-13697
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4cwx-7wf7-3272
Release Date: 2026-07-29
Fix Resolution: undici - 7.29.0,undici - 8.9.0,https://github.com/nodejs/undici.git - v8.9.0,https://github.com/nodejs/undici.git - v7.29.0
CVE-2026-65898
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Publish Date: 2026-07-23
URL: CVE-2026-65898
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@0cae518
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.11,https://github.com/cure53/DOMPurify.git - 3.4.11
CVE-2026-41238
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses "DOMPurify.sanitize()" with the default configuration (no "CUSTOM_ELEMENT_HANDLING" option), a prior prototype pollution gadget can inject permissive "tagNameCheck" and "attributeNameCheck" regex values into "Object.prototype", causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Affected Versions - 3.0.1 through 3.3.3 (current latest) — all affected - 3.0.0 and all 2.x versions — NOT affected (used "Object.create(null)" for initialization, no "|| {}" reassignment) - The vulnerable "|| {}" reassignment was introduced in the 3.0.0→3.0.1 refactor - This is distinct from GHSA-cj63-jhhr-wcxv (USE_PROFILES Array.prototype pollution, fixed in 3.3.2) - This is distinct from CVE-2024-45801 / GHSA-mmhx-hmjr-r674 (__depth prototype pollution, fixed in 3.1.3) Root Cause In "purify.js" at line 590, during config parsing: CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; When no "CUSTOM_ELEMENT_HANDLING" is specified in the config (the default usage pattern), "cfg.CUSTOM_ELEMENT_HANDLING" is "undefined", and the fallback "{}" is used. This plain object inherits from "Object.prototype". Lines 591-598 then check "cfg.CUSTOM_ELEMENT_HANDLING" (the original config property) — which is "undefined" — so the conditional blocks that would set "tagNameCheck" and "attributeNameCheck" from the config are never entered. As a result, "CUSTOM_ELEMENT_HANDLING.tagNameCheck" and "CUSTOM_ELEMENT_HANDLING.attributeNameCheck" resolve via the prototype chain. If an attacker has polluted "Object.prototype.tagNameCheck" and "Object.prototype.attributeNameCheck" with permissive values (e.g., "/.*/"), these polluted values flow into DOMPurify's custom element validation at lines 973-977 and attribute validation, causing all custom elements and all attributes to be allowed. Impact - Attack type: XSS bypass via prototype pollution chain - Prerequisites: Attacker must have a prototype pollution primitive in the same execution context (e.g., vulnerable version of lodash, jQuery.extend, query-string parser, deep merge utility, or any other PP gadget) - Config required: Default. No special DOMPurify configuration needed. The standard "DOMPurify.sanitize(userInput)" call is affected. - Payload: Any HTML custom element (name containing a hyphen) with event handler attributes survives sanitization.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41238
CVSS 3 Score Details (6.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-v9jr-rg53-9pgp
Release Date: 2026-04-22
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
CVE-2026-41239
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Summary | Field | Value | |:------|:------| | Severity | Medium | | Affected | DOMPurify "main" at ""883ac15"" (https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 (""7fc196db"" (cure53/DOMPurify@7fc196d)) | "SAFE_FOR_TEMPLATES" strips "{{...}}" expressions from untrusted HTML. This works in string mode but not with "RETURN_DOM" or "RETURN_DOM_FRAGMENT", allowing XSS via template-evaluating frameworks like Vue 2. Technical Details DOMPurify strips template expressions in two passes: 1. Per-node — each text node is checked during the tree walk (""purify.ts:1179-1191"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1179-L1191)): // pass #1: runs on every text node during tree walk if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { content = currentNode.textContent; content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' ' content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' ' content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' ' currentNode.textContent = content; } 2. Final string scrub — after serialization, the full HTML string is scrubbed again (""purify.ts:1679-1683"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1679-L1683)). This is the safety net that catches expressions that only form after the DOM settles. The "RETURN_DOM" path returns before pass #2 ever runs (""purify.ts:1637-1661"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1637-L1661)): // purify.ts (simplified) if (RETURN_DOM) { // ... build returnNode ... return returnNode; // <-- exits here, pass #2 never runs } // pass #2: only reached by string-mode callers if (SAFE_FOR_TEMPLATES) { serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' '); } return serializedHTML; The payload "{{constructor.constructor('alert(1)')()}}" exploits this: 3. Parser creates: "TEXT("{")" → "" → "TEXT("{payload}")" → "" → "TEXT("}")" — no single node contains "{{", so pass #1 misses it 4. "" is not allowed, so DOMPurify removes it but keeps surrounding text 5. The three text nodes are now adjacent — ".outerHTML" reads them as "{{payload}}", which Vue 2 compiles and executes
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41239
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-crv5-9vww-q3g8
Release Date: 2026-04-22
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
CVE-2026-41240
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
There is an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit "c361baa" (cure53/DOMPurify@c361baa) added an early exit for FORBID_ATTR at line 1214: /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it / if (FORBID_ATTR[lcName]) { return false; } The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely: if ( !( EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName) // true -> short-circuits ) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) // never evaluated ) { This allows forbidden elements to survive sanitization with their attributes intact.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41240
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-h7mw-gpvr-xq4m
Release Date: 2026-04-23
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
CVE-2026-1525
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- jsdom-28.0.0.tgz
- ❌ undici-7.21.0.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
- Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
- Applications that accept user-controlled header names without case-normalization
Potential consequences:
- Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
- HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Publish Date: 2026-03-12
URL: CVE-2026-1525
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-2mjp-6q6p-2qxm
Release Date: 2026-03-12
Fix Resolution: undici - 6.24.0,undici - 7.24.0
CVE-2026-66010
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
Publish Date: 2026-07-24
URL: CVE-2026-66010
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c2j3-45gr-mqc4
Release Date: 2026-07-24
Fix Resolution: dompurify - 3.4.12,dompurify - 3.4.12,https://github.com/cure53/DOMPurify.git - 3.4.12
CVE-2026-65914
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
Publish Date: 2026-07-23
URL: CVE-2026-65914
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
CVE-2026-65913
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Publish Date: 2026-07-23
URL: CVE-2026-65913
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
CVE-2026-65912
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Publish Date: 2026-07-23
URL: CVE-2026-65912
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
CVE-2026-65911
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Publish Date: 2026-07-23
URL: CVE-2026-65911
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5b16e0b
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0
CVE-2026-65903
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Publish Date: 2026-07-23
URL: CVE-2026-65903
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5b16e0b
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0
CVE-2026-65902
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
- ibmdotcom-utilities-2.54.0.tgz (Root Library)
- isomorphic-dompurify-2.36.0.tgz
- ❌ dompurify-3.3.1.tgz (Vulnerable Library)
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.
Publish Date: 2026-07-23
URL: CVE-2026-65902
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@ca30f07
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.7,https://github.com/cure53/DOMPurify.git - 3.4.7
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Publish Date: 2026-07-14
URL: CVE-2026-49978
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@ca30f07
Release Date: 2026-06-15
Fix Resolution: https://github.com/cure53/DOMPurify.git - 3.4.7
Vulnerable Library - js-cookie-2.2.1.tgz
A simple, lightweight JavaScript API for handling cookies
Library home page: https://registry.npmjs.org/js-cookie/-/js-cookie-2.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/js-cookie-npm-2.2.1-e879cd2148-4387f5f569.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.proto setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-06-10
URL: CVE-2026-46625
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qjx8-664m-686j
Release Date: 2026-05-23
Fix Resolution: js-cookie - 3.0.7,https://github.com/js-cookie/js-cookie.git - v3.0.7
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.
The vulnerability exists because:
Publish Date: 2026-03-12
URL: CVE-2026-2229
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-v9p9-hfj2-hcw8
Release Date: 2026-03-12
Fix Resolution: undici - 6.24.0,undici - 7.24.0
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.
The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
Publish Date: 2026-03-12
URL: CVE-2026-1526
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vrm6-8vpv-qv8q
Release Date: 2026-03-12
Fix Resolution: undici - 7.24.0,undici - 6.24.0
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Impact:
The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.
Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
All releases starting at undici 6.17.0 are affected.
Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:
No workaround is available. The fix must be applied through an upgrade.
Publish Date: 2026-06-17
URL: CVE-2026-12151
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vxpw-j846-p89q
Release Date: 2026-06-17
Fix Resolution: undici - 8.5.0,undici - 6.27.0,undici - 7.28.0,https://github.com/nodejs/undici.git - v7.28.0,https://github.com/nodejs/undici.git - v6.27.0,https://github.com/nodejs/undici.git - v8.5.0
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
Publish Date: 2026-07-29
URL: CVE-2026-13697
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4cwx-7wf7-3272
Release Date: 2026-07-29
Fix Resolution: undici - 7.29.0,undici - 8.9.0,https://github.com/nodejs/undici.git - v8.9.0,https://github.com/nodejs/undici.git - v7.29.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Publish Date: 2026-07-23
URL: CVE-2026-65898
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@0cae518
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.11,https://github.com/cure53/DOMPurify.git - 3.4.11
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses "DOMPurify.sanitize()" with the default configuration (no "CUSTOM_ELEMENT_HANDLING" option), a prior prototype pollution gadget can inject permissive "tagNameCheck" and "attributeNameCheck" regex values into "Object.prototype", causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Affected Versions - 3.0.1 through 3.3.3 (current latest) — all affected - 3.0.0 and all 2.x versions — NOT affected (used "Object.create(null)" for initialization, no "|| {}" reassignment) - The vulnerable "|| {}" reassignment was introduced in the 3.0.0→3.0.1 refactor - This is distinct from GHSA-cj63-jhhr-wcxv (USE_PROFILES Array.prototype pollution, fixed in 3.3.2) - This is distinct from CVE-2024-45801 / GHSA-mmhx-hmjr-r674 (__depth prototype pollution, fixed in 3.1.3) Root Cause In "purify.js" at line 590, during config parsing: CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; When no "CUSTOM_ELEMENT_HANDLING" is specified in the config (the default usage pattern), "cfg.CUSTOM_ELEMENT_HANDLING" is "undefined", and the fallback "{}" is used. This plain object inherits from "Object.prototype". Lines 591-598 then check "cfg.CUSTOM_ELEMENT_HANDLING" (the original config property) — which is "undefined" — so the conditional blocks that would set "tagNameCheck" and "attributeNameCheck" from the config are never entered. As a result, "CUSTOM_ELEMENT_HANDLING.tagNameCheck" and "CUSTOM_ELEMENT_HANDLING.attributeNameCheck" resolve via the prototype chain. If an attacker has polluted "Object.prototype.tagNameCheck" and "Object.prototype.attributeNameCheck" with permissive values (e.g., "/.*/"), these polluted values flow into DOMPurify's custom element validation at lines 973-977 and attribute validation, causing all custom elements and all attributes to be allowed. Impact - Attack type: XSS bypass via prototype pollution chain - Prerequisites: Attacker must have a prototype pollution primitive in the same execution context (e.g., vulnerable version of lodash, jQuery.extend, query-string parser, deep merge utility, or any other PP gadget) - Config required: Default. No special DOMPurify configuration needed. The standard "DOMPurify.sanitize(userInput)" call is affected. - Payload: Any HTML custom element (name containing a hyphen) with event handler attributes survives sanitization.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41238
CVSS 3 Score Details (6.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-v9jr-rg53-9pgp
Release Date: 2026-04-22
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Summary | Field | Value | |:------|:------| | Severity | Medium | | Affected | DOMPurify "main" at ""883ac15"" (https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 (""7fc196db"" (cure53/DOMPurify@7fc196d)) | "SAFE_FOR_TEMPLATES" strips "{{...}}" expressions from untrusted HTML. This works in string mode but not with "RETURN_DOM" or "RETURN_DOM_FRAGMENT", allowing XSS via template-evaluating frameworks like Vue 2. Technical Details DOMPurify strips template expressions in two passes: 1. Per-node — each text node is checked during the tree walk (""purify.ts:1179-1191"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1179-L1191)): // pass #1: runs on every text node during tree walk if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) { content = currentNode.textContent; content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' ' content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' ' content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' ' currentNode.textContent = content; } 2. Final string scrub — after serialization, the full HTML string is scrubbed again (""purify.ts:1679-1683"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1679-L1683)). This is the safety net that catches expressions that only form after the DOM settles. The "RETURN_DOM" path returns before pass #2 ever runs (""purify.ts:1637-1661"" (https://github.com/cure53/DOMPurify/blob/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6/src/purify.ts#L1637-L1661)): // purify.ts (simplified) if (RETURN_DOM) { // ... build returnNode ... return returnNode; // <-- exits here, pass #2 never runs } // pass #2: only reached by string-mode callers if (SAFE_FOR_TEMPLATES) { serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' '); } return serializedHTML; The payload "{{constructor.constructor('alert(1)')()}}" exploits this: 3. Parser creates: "TEXT("{")" → "" → "TEXT("{payload}")" → "" → "TEXT("}")" — no single node contains "{{", so pass #1 misses it 4. "" is not allowed, so DOMPurify removes it but keeps surrounding text 5. The three text nodes are now adjacent — ".outerHTML" reads them as "{{payload}}", which Vue 2 compiles and executes
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41239
CVSS 3 Score Details (6.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-crv5-9vww-q3g8
Release Date: 2026-04-22
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
There is an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit "c361baa" (cure53/DOMPurify@c361baa) added an early exit for FORBID_ATTR at line 1214: /* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it / if (FORBID_ATTR[lcName]) { return false; } The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely: if ( !( EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName) // true -> short-circuits ) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) // never evaluated ) { This allows forbidden elements to survive sanitization with their attributes intact.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-23
URL: CVE-2026-41240
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-h7mw-gpvr-xq4m
Release Date: 2026-04-23
Fix Resolution: dompurify - 3.4.0,dompurify - 3.4.0
Vulnerable Library - undici-7.21.0.tgz
An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-7.21.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/undici-npm-7.21.0-babfc213f0-2025ba33bd.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.
Who is impacted:
Potential consequences:
Publish Date: 2026-03-12
URL: CVE-2026-1525
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-2mjp-6q6p-2qxm
Release Date: 2026-03-12
Fix Resolution: undici - 6.24.0,undici - 7.24.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
Publish Date: 2026-07-24
URL: CVE-2026-66010
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c2j3-45gr-mqc4
Release Date: 2026-07-24
Fix Resolution: dompurify - 3.4.12,dompurify - 3.4.12,https://github.com/cure53/DOMPurify.git - 3.4.12
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
Publish Date: 2026-07-23
URL: CVE-2026-65914
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Publish Date: 2026-07-23
URL: CVE-2026-65913
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Publish Date: 2026-07-23
URL: CVE-2026-65912
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5cad4ce
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.3.2,https://github.com/cure53/DOMPurify.git - 3.3.2
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Publish Date: 2026-07-23
URL: CVE-2026-65911
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5b16e0b
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Publish Date: 2026-07-23
URL: CVE-2026-65903
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@5b16e0b
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.0,https://github.com/cure53/DOMPurify.git - 3.4.0
Vulnerable Library - dompurify-3.3.1.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /.yarn/cache/dompurify-npm-3.3.1-5bbe58c5ff-f71cca489e.zip
Dependency Hierarchy:
Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd
Found in base branch: main
Vulnerability Details
DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.
Publish Date: 2026-07-23
URL: CVE-2026-65902
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: cure53/DOMPurify@ca30f07
Release Date: 2026-07-23
Fix Resolution: dompurify - 3.4.7,https://github.com/cure53/DOMPurify.git - 3.4.7