Every CVE Search/ Get API key

CVE-2026-116803

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

5.1 MediumFix available

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.16%Unchanged since Oct 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
CVE-2026-116803
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-110511 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
EUVD-2026-110511
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-77h4-4vqj-j7vc 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to...

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
GHSA-77h4-4vqj-j7vc
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
CVE-2026-116803
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.1

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
CVE-2026-116803
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-116803 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
DEBIAN-CVE-2026-116803
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
Show 42 moreShow less
OSVUBUNTU-CVE-2026-116803 5.1

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Record
UBUNTU-CVE-2026-116803
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1793097032 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.0-tuxcare.10.

Record
CLSA-2026-1793097032
Updated
2026-11-02
OSVCLSA-2026-1793097070 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.3.3-tuxcare.5.

Record
CLSA-2026-1793097070
Updated
2026-11-02
OSVCLSA-2026-1793097137 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.9-tuxcare.5.

Record
CLSA-2026-1793097137
Updated
2026-11-02
OSVCLSA-2026-1793097251 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.3-tuxcare.9.

Record
CLSA-2026-1793097251
Updated
2026-11-02
OSVCLSA-2026-1793097362 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.6-tuxcare.6.

Record
CLSA-2026-1793097362
Updated
2026-11-02
OSVCLSA-2026-1793097542 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.0-tuxcare.10.

Record
CLSA-2026-1793097542
Updated
2026-11-02
OSVCLSA-2026-1793097697 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.3-tuxcare.5.

Record
CLSA-2026-1793097697
Updated
2026-11-02
OSVCLSA-2026-1793100794 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.5-tuxcare.5.

Record
CLSA-2026-1793100794
Updated
2026-11-02
OSVCLSA-2026-1793100979 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.8-tuxcare.7.

Record
CLSA-2026-1793100979
Updated
2026-11-02
OSVCLSA-2026-1793101079 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.13-tuxcare.3.

Record
CLSA-2026-1793101079
Updated
2026-11-02
OSVCLSA-2026-1793101206 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.11-tuxcare.5.

Record
CLSA-2026-1793101206
Updated
2026-11-02
OSVCLSA-2026-1793101291 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.6-tuxcare.5.

Record
CLSA-2026-1793101291
Updated
2026-11-02
OSVCLSA-2026-1793101437 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.7-tuxcare.5.

Record
CLSA-2026-1793101437
Updated
2026-11-02
OSVCLSA-2026-1793101539 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.14-tuxcare.4.

Record
CLSA-2026-1793101539
Updated
2026-11-02
OSVCLSA-2026-1793101597 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.9-tuxcare.5.

Record
CLSA-2026-1793101597
Updated
2026-11-02
OSVCLSA-2026-1793101643 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.11-tuxcare.5.

Record
CLSA-2026-1793101643
Updated
2026-11-02
OSVCLSA-2026-1793101664 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.1-tuxcare.5.

Record
CLSA-2026-1793101664
Updated
2026-11-02
OSVCLSA-2026-1793101714 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.6-tuxcare.5.

Record
CLSA-2026-1793101714
Updated
2026-11-02
OSVCLSA-2026-1793101764 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.0-tuxcare.2.

Record
CLSA-2026-1793101764
Updated
2026-11-02
OSVCLSA-2026-1793101815 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.3-tuxcare.7.

Record
CLSA-2026-1793101815
Updated
2026-11-02
OSVCLSA-2026-1793101830 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.4-tuxcare.5.

Record
CLSA-2026-1793101830
Updated
2026-11-02
OSVCLSA-2026-1793101846 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.6-tuxcare.11.

Record
CLSA-2026-1793101846
Updated
2026-11-02
OSVCLSA-2026-1793101871 No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.

Record
CLSA-2026-1793101871
Updated
2026-11-02
OSVCLSA-2026-1793101938 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.10-tuxcare.5.

Record
CLSA-2026-1793101938
Updated
2026-11-02
OSVCLSA-2026-1793102041 No score

TuxCare security update for dompurify (11 CVEs)

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.

Record
CLSA-2026-1793102041
Updated
2026-11-02
OSVCLSA-2026-1793102164 No score

TuxCare security update for dompurify (4 CVEs)

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.12-tuxcare.3.

Record
CLSA-2026-1793102164
Updated
2026-11-02
OSVCLSA-2026-1793102424 No score

TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.4.15-tuxcare.3.

Record
CLSA-2026-1793102424
Updated
2026-11-02
OSVCLSA-2026-1793109624 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.9-tuxcare.13.

Record
CLSA-2026-1793109624
Updated
2026-11-02
OSVCLSA-2026-1793109867 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.10.

Record
CLSA-2026-1793109867
Updated
2026-11-02
OSVCLSA-2026-1793110512 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.3-tuxcare.13.

Record
CLSA-2026-1793110512
Updated
2026-11-02
OSVCLSA-2026-1793112297 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.0.8-tuxcare.7.

Record
CLSA-2026-1793112297
Updated
2026-11-02
OSVCLSA-2026-1793120016 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.0-tuxcare.5.

Record
CLSA-2026-1793120016
Updated
2026-11-02
OSVCLSA-2026-1793120032 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.1.2-tuxcare.5.

Record
CLSA-2026-1793120032
Updated
2026-11-02
OSVCLSA-2026-1793120128 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.8-tuxcare.11.

Record
CLSA-2026-1793120128
Updated
2026-11-02
OSVCLSA-2026-1793120140 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.8-tuxcare.5.

Record
CLSA-2026-1793120140
Updated
2026-11-02
OSVCLSA-2026-1793126384 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.2-tuxcare.5.

Record
CLSA-2026-1793126384
Updated
2026-11-02
OSVCLSA-2026-1793126491 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.1-tuxcare.5.

Record
CLSA-2026-1793126491
Updated
2026-11-02
OSVCLSA-2026-1793127475 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.10-tuxcare.5.

Record
CLSA-2026-1793127475
Updated
2026-11-02
OSVCLSA-2026-1793127593 No score

TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.3-tuxcare.5.

Record
CLSA-2026-1793127593
Updated
2026-11-02
OSVCLSA-2026-1793129489 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.2.7-tuxcare.7.

Record
CLSA-2026-1793129489
Updated
2026-11-02
OSVCLSA-2026-1793129671 No score

TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.16-tuxcare.2.

Record
CLSA-2026-1793129671
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dompurify
TuxCare:npm
 2.4.0-tuxcare.0 up to 2.4.0-tuxcare.10, plus listed versions
2.4.02.4.0-tuxcare.12.4.0-tuxcare.22.4.0-tuxcare.32.4.0-tuxcare.4
Show 5 moreShow less
2.4.0-tuxcare.52.4.0-tuxcare.62.4.0-tuxcare.72.4.0-tuxcare.82.4.0-tuxcare.9
2.4.0-tuxcare.10
dompurify
TuxCare:npm
 3.3.3-tuxcare.0 up to 3.3.3-tuxcare.5, plus listed versions
3.3.33.3.3-tuxcare.13.3.3-tuxcare.23.3.3-tuxcare.33.3.3-tuxcare.4
3.3.3-tuxcare.5
dompurify
TuxCare:npm
 3.0.9-tuxcare.0 up to 3.0.9-tuxcare.5, plus listed versions
3.0.93.0.9-tuxcare.13.0.9-tuxcare.23.0.9-tuxcare.33.0.9-tuxcare.4
3.0.9-tuxcare.5
dompurify
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.9, plus listed versions
3.0.33.0.3-tuxcare.13.0.3-tuxcare.23.0.3-tuxcare.33.0.3-tuxcare.4
Show 4 moreShow less
3.0.3-tuxcare.53.0.3-tuxcare.63.0.3-tuxcare.73.0.3-tuxcare.8
3.0.3-tuxcare.9
dompurify
TuxCare:npm
 3.0.6-tuxcare.0 up to 3.0.6-tuxcare.6, plus listed versions
3.0.63.0.6-tuxcare.13.0.6-tuxcare.23.0.6-tuxcare.33.0.6-tuxcare.43.0.6-tuxcare.5
3.0.6-tuxcare.6
dompurify
TuxCare:npm
 2.3.0-tuxcare.0 up to 2.3.0-tuxcare.10, plus listed versions
2.3.02.3.0-tuxcare.12.3.0-tuxcare.22.3.0-tuxcare.32.3.0-tuxcare.4
Show 5 moreShow less
2.3.0-tuxcare.52.3.0-tuxcare.62.3.0-tuxcare.72.3.0-tuxcare.82.3.0-tuxcare.9
2.3.0-tuxcare.10
dompurify
TuxCare:npm
 3.1.3-tuxcare.0 up to 3.1.3-tuxcare.5, plus listed versions
3.1.33.1.3-tuxcare.13.1.3-tuxcare.23.1.3-tuxcare.33.1.3-tuxcare.4
3.1.3-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.5-tuxcare.0 up to 3.4.5-tuxcare.5, plus listed versions
3.4.53.4.5-tuxcare.13.4.5-tuxcare.23.4.5-tuxcare.33.4.5-tuxcare.4
3.4.5-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.8-tuxcare.0 up to 3.4.8-tuxcare.7, plus listed versions
3.4.83.4.8-tuxcare.13.4.8-tuxcare.23.4.8-tuxcare.33.4.8-tuxcare.43.4.8-tuxcare.53.4.8-tuxcare.6
3.4.8-tuxcare.7
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.13-tuxcare.0 up to 3.4.13-tuxcare.3, plus listed versions
3.4.133.4.13-tuxcare.13.4.13-tuxcare.2
3.4.13-tuxcare.3
Show 38 moreShow less
Affected packages
PackageAffectedFixed
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.11-tuxcare.0 up to 3.4.11-tuxcare.5, plus listed versions
3.4.113.4.11-tuxcare.13.4.11-tuxcare.23.4.11-tuxcare.33.4.11-tuxcare.4
3.4.11-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.6-tuxcare.0 up to 3.4.6-tuxcare.5, plus listed versions
3.4.63.4.6-tuxcare.13.4.6-tuxcare.23.4.6-tuxcare.33.4.6-tuxcare.4
3.4.6-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.7-tuxcare.0 up to 3.4.7-tuxcare.5, plus listed versions
3.4.73.4.7-tuxcare.13.4.7-tuxcare.23.4.7-tuxcare.33.4.7-tuxcare.4
3.4.7-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.14-tuxcare.0 up to 3.4.14-tuxcare.4, plus listed versions
3.4.143.4.14-tuxcare.13.4.14-tuxcare.23.4.14-tuxcare.3
3.4.14-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.9-tuxcare.0 up to 3.4.9-tuxcare.5, plus listed versions
3.4.93.4.9-tuxcare.13.4.9-tuxcare.23.4.9-tuxcare.33.4.9-tuxcare.4
3.4.9-tuxcare.5
dompurify
TuxCare:npm
 3.0.11-tuxcare.0 up to 3.0.11-tuxcare.5, plus listed versions
3.0.113.0.11-tuxcare.13.0.11-tuxcare.23.0.11-tuxcare.33.0.11-tuxcare.4
3.0.11-tuxcare.5
dompurify
TuxCare:npm
 3.1.1-tuxcare.0 up to 3.1.1-tuxcare.5, plus listed versions
3.1.13.1.1-tuxcare.13.1.1-tuxcare.23.1.1-tuxcare.33.1.1-tuxcare.4
3.1.1-tuxcare.5
dompurify
TuxCare:npm
 3.2.6-tuxcare.0 up to 3.2.6-tuxcare.5, plus listed versions
3.2.63.2.6-tuxcare.13.2.6-tuxcare.23.2.6-tuxcare.33.2.6-tuxcare.4
3.2.6-tuxcare.5
dompurify
TuxCare:npm
 3.4.0-tuxcare.0 up to 3.4.0-tuxcare.2, plus listed versions
3.4.03.4.0-tuxcare.1
3.4.0-tuxcare.2
dompurify
TuxCare:npm
 3.2.3-tuxcare.0 up to 3.2.3-tuxcare.7, plus listed versions
3.2.33.2.3-tuxcare.13.2.3-tuxcare.23.2.3-tuxcare.33.2.3-tuxcare.43.2.3-tuxcare.53.2.3-tuxcare.6
3.2.3-tuxcare.7
dompurify
TuxCare:npm
 3.1.4-tuxcare.0 up to 3.1.4-tuxcare.5, plus listed versions
3.1.43.1.4-tuxcare.13.1.4-tuxcare.23.1.4-tuxcare.33.1.4-tuxcare.4
3.1.4-tuxcare.5
dompurify
TuxCare:npm
 3.1.6-tuxcare.0 up to 3.1.6-tuxcare.11, plus listed versions
3.1.63.1.6-tuxcare.13.1.6-tuxcare.103.1.6-tuxcare.23.1.6-tuxcare.3
Show 6 moreShow less
3.1.6-tuxcare.43.1.6-tuxcare.53.1.6-tuxcare.63.1.6-tuxcare.73.1.6-tuxcare.83.1.6-tuxcare.9
3.1.6-tuxcare.11
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
 3.0.5-tuxcare.0 up to 3.0.5-tuxcare.4, plus listed versions
3.0.53.0.5-tuxcare.13.0.5-tuxcare.23.0.5-tuxcare.3
3.0.5-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.10-tuxcare.0 up to 3.4.10-tuxcare.5, plus listed versions
3.4.103.4.10-tuxcare.13.4.10-tuxcare.23.4.10-tuxcare.33.4.10-tuxcare.4
3.4.10-tuxcare.5
dompurify
TuxCare:npm
From an advisory covering 10 CVEs
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.4, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.3
3.0.4-tuxcare.4
dompurify
TuxCare:npm
From an advisory covering 3 CVEs
 3.4.12-tuxcare.0 up to 3.4.12-tuxcare.3, plus listed versions
3.4.123.4.12-tuxcare.13.4.12-tuxcare.2
3.4.12-tuxcare.3
dompurify
TuxCare:npm
From an advisory covering 2 CVEs
 3.4.15-tuxcare.0 up to 3.4.15-tuxcare.3, plus listed versions
3.4.153.4.15-tuxcare.13.4.15-tuxcare.2
3.4.15-tuxcare.3
dompurify
TuxCare:npm
 2.5.9-tuxcare.0 up to 2.5.9-tuxcare.13, plus listed versions
2.5.92.5.9-tuxcare.12.5.9-tuxcare.102.5.9-tuxcare.112.5.9-tuxcare.12
Show 8 moreShow less
2.5.9-tuxcare.22.5.9-tuxcare.32.5.9-tuxcare.42.5.9-tuxcare.52.5.9-tuxcare.62.5.9-tuxcare.72.5.9-tuxcare.82.5.9-tuxcare.9
2.5.9-tuxcare.13
dompurify
TuxCare:npm
 2.4.7-tuxcare.0 up to 2.4.7-tuxcare.10, plus listed versions
2.4.72.4.7-tuxcare.12.4.7-tuxcare.22.4.7-tuxcare.32.4.7-tuxcare.4
Show 5 moreShow less
2.4.7-tuxcare.52.4.7-tuxcare.62.4.7-tuxcare.72.4.7-tuxcare.82.4.7-tuxcare.9
2.4.7-tuxcare.10
dompurify
TuxCare:npm
 2.4.3-tuxcare.0 up to 2.4.3-tuxcare.13, plus listed versions
2.4.32.4.3-tuxcare.12.4.3-tuxcare.102.4.3-tuxcare.112.4.3-tuxcare.12
Show 8 moreShow less
2.4.3-tuxcare.22.4.3-tuxcare.32.4.3-tuxcare.42.4.3-tuxcare.52.4.3-tuxcare.62.4.3-tuxcare.72.4.3-tuxcare.82.4.3-tuxcare.9
2.4.3-tuxcare.13
dompurify
TuxCare:npm
 2.0.8-tuxcare.0 up to 2.0.8-tuxcare.7, plus listed versions
2.0.82.0.8-tuxcare.12.0.8-tuxcare.22.0.8-tuxcare.32.0.8-tuxcare.42.0.8-tuxcare.52.0.8-tuxcare.6
2.0.8-tuxcare.7
dompurify
TuxCare:npm
 3.1.0-tuxcare.0 up to 3.1.0-tuxcare.5, plus listed versions
3.1.03.1.0-tuxcare.13.1.0-tuxcare.23.1.0-tuxcare.33.1.0-tuxcare.4
3.1.0-tuxcare.5
dompurify
TuxCare:npm
 3.1.2-tuxcare.0 up to 3.1.2-tuxcare.5, plus listed versions
3.1.23.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.33.1.2-tuxcare.4
3.1.2-tuxcare.5
dompurify
TuxCare:npm
 2.5.8-tuxcare.0 up to 2.5.8-tuxcare.11, plus listed versions
2.5.82.5.8-tuxcare.12.5.8-tuxcare.102.5.8-tuxcare.22.5.8-tuxcare.3
Show 6 moreShow less
2.5.8-tuxcare.42.5.8-tuxcare.52.5.8-tuxcare.62.5.8-tuxcare.72.5.8-tuxcare.82.5.8-tuxcare.9
2.5.8-tuxcare.11
dompurify
TuxCare:npm
 3.0.8-tuxcare.0 up to 3.0.8-tuxcare.5, plus listed versions
3.0.83.0.8-tuxcare.13.0.8-tuxcare.23.0.8-tuxcare.33.0.8-tuxcare.4
3.0.8-tuxcare.5
dompurify
TuxCare:npm
 3.0.2-tuxcare.0 up to 3.0.2-tuxcare.5, plus listed versions
3.0.23.0.2-tuxcare.13.0.2-tuxcare.23.0.2-tuxcare.33.0.2-tuxcare.4
3.0.2-tuxcare.5
dompurify
TuxCare:npm
 3.0.1-tuxcare.0 up to 3.0.1-tuxcare.5, plus listed versions
3.0.13.0.1-tuxcare.13.0.1-tuxcare.23.0.1-tuxcare.33.0.1-tuxcare.4
3.0.1-tuxcare.5
dompurify
TuxCare:npm
 2.3.10-tuxcare.0 up to 2.3.10-tuxcare.5, plus listed versions
2.3.102.3.10-tuxcare.12.3.10-tuxcare.22.3.10-tuxcare.32.3.10-tuxcare.4
2.3.10-tuxcare.5
dompurify
TuxCare:npm
 2.3.3-tuxcare.0 up to 2.3.3-tuxcare.5, plus listed versions
2.3.32.3.3-tuxcare.12.3.3-tuxcare.22.3.3-tuxcare.32.3.3-tuxcare.4
2.3.3-tuxcare.5
dompurify
TuxCare:npm
 3.2.7-tuxcare.0 up to 3.2.7-tuxcare.7, plus listed versions
3.2.73.2.7-tuxcare.13.2.7-tuxcare.23.2.7-tuxcare.33.2.7-tuxcare.43.2.7-tuxcare.53.2.7-tuxcare.6
3.2.7-tuxcare.7
dompurify
TuxCare:npm
 3.4.16-tuxcare.0 up to 3.4.16-tuxcare.2, plus listed versions
3.4.163.4.16-tuxcare.1
3.4.16-tuxcare.2
node-dompurify
Debian:12
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-22.4.1+dfsg+~2.4.0-2+deb12u13.0.9+dfsg+~3.0.5-13.1.6+dfsg+~3.0.5-1
Show 14 moreShow less
3.1.7+dfsg+~3.0.5-13.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-23.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.17+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:13
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 8 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.17+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
 None known
node-dompurify
Debian:14
 before 3.4.17+dfsg-1, plus listed versions
3.1.7+dfsg+~3.0.5-23.2.5+dfsg-13.3.2+dfsg-13.3.3+dfsg-13.3.3+dfsg-2
Show 7 moreShow less
3.4.1+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-23.4.16+dfsg-13.4.2+dfsg-13.4.5+dfsg-1
3.4.17+dfsg-1
node-dompurify
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg-22.3.3+dfsg-1
 None known
node-dompurify
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.4.1+dfsg+~2.4.0-13.0.9+dfsg+~3.0.5-1
 None known
node-dompurify
Ubuntu:26.10
 All versions, plus listed versions
3.3.3+dfsg-13.4.2+dfsg-13.4.5+dfsg-13.4.12+dfsg-13.4.13+dfsg-13.4.13+dfsg-2
 None known
node-dompurify
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.7+dfsg+~3.0.5-23.3.3+dfsg-1
 None known

History

History
RecordedChangedSources
affected
facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116803 is a medium vulnerability (CVSS 5.1) in Cure53 Dompurify, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in dompurify 2.4.0-tuxcare.10.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open