npm/dompurify CVE-2026-41239: medium 6.8, EPSS 0.41%

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

Action: Upgrade dompurify to 3.4.0 or later.

npm i dompurify@3.4.0

Affected

Fixed versions

Sources

• osv: GHSA-crv5-9vww-q3g8
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.0

CVE-2026-41239 · published 2026-04-22T17:32:54Z · modified 2026-09-10T03:50:43.947374186Z · JSON