npm/dompurify CVE-2026-49458: medium 6.1, EPSS 0.40%

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

Action: Upgrade dompurify to 3.4.6 or later.

npm i dompurify@3.4.6

Affected

Fixed versions

Sources

• osv: GHSA-hpcv-96wg-7vj8
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8
• https://github.com/cure53/DOMPurify

CVE-2026-49458 · published 2026-06-15T19:56:35Z · modified 2026-09-10T03:50:49.943821317Z · JSON