Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cure53 | DOMPurify | < 3.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-dompurify | 3.4.1+dfsg-1 | — |
| Debian 13 | node-dompurify | No fix yet | — |
| Debian 12 | node-dompurify | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-dompurify | No fix yet | — |
| Ubuntu 26.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 25.10 | node-dompurify | No fix yet | — |
| Ubuntu 24.04 LTS | node-dompurify | No fix yet | — |
| Ubuntu 22.04 LTS | node-dompurify | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.13-2.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.13-2.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.10-1.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el9ap | RHSA-2026:34160 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el9ap | RHSA-2026:34160 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | argocd-cli | 3.4.3-1.1 | openSUSE-SU-2026:10888-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r0 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.6.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dompurify | < 3.4.0 | 3.4.0 | GHSA-h7mw-gpvr-xq4m |
Advisories 6
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:34160 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-3000 Red Hat Enterprise Linux (Apicurio Registry): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-2892 Oracle Construction and Engineering: Schwachstelle gefährdet Vertraulichkeit und Integrität BSI CERT-Bund (WID) · Aug 18, 2026
- WID-SEC-2026-1407 IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
- openSUSE-SU-2026:10888-1 argocd-cli-3.4.3-1.1 on GA media SUSE / openSUSE Security Updates · May 30, 2026