CVE-2026-65898
1 advisory.
npm/dompurify CVE-2026-65898: medium, EPSS 0.21%
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
Action: Upgrade dompurify to 3.4.11 or later.
npm i dompurify@3.4.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.11 | - |
Fixed versions
| 3.4.11 |
Sources
- osv: GHSA-cmwh-pvxp-8882
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882
- https://github.com/cure53/DOMPurify/pull/1482
- https://github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9
- https://github.com/cure53/DOMPurify
- https://github.com/cure53/DOMPurify/releases/tag/3.4.11
CVE-2026-65898 · published · modified · JSON