npm/dompurify CVE-2026-65899: low, EPSS 0.41%
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
Action: Upgrade dompurify to 3.4.9 or later.
npm i dompurify@3.4.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.9 | - |
Fixed versions
| 3.4.9 |
Sources
- osv: GHSA-vxr8-fq34-vvx9
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9
- https://github.com/cure53/DOMPurify
CVE-2026-65899 · published · modified · JSON