Fluid Attacks Database

Description

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	node-dompurify	=2.4.1+dfsg+~2.4.0-1 \|\| =2.4.1+dfsg+~2.4.0-2 \|\| =2.4.1+dfsg+~2.4.0-2+deb12u1 \|\| =3.0.9+dfsg+~3.0.5-1 \|\| =3.1.6+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.16+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
rpm rhel10	grafana-pcp	-	-
debian 14	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| >=0 <3.4.1+dfsg-1	3.4.1+dfsg-1
npm	dompurify	>=0 <3.4.0	3.4.0
debian 13	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.16+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
rpm rhel9	grafana	-	-
rpm rhel10	grafana	-	-
rpm rhel8	grafana	-	-
rpm rhel10	cockpit-image-builder	-	-
rpm rhel10	ceph	-	-

Aliases

1. CVE-2026-659032. NVD-2026-659033. OSV-DEBIAN-2026-659034. OSV-2026-659035. GHSA-39q2-94rc-95cp6. GCVE-2026-659037. SECURITY-TRACKER-CVE-2026-65903

References

1. https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.