p PatchFirst

CVE-2026-41240

CVE-2026-41240 · DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.

CVSS 6.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • dompurify

    Versions
    • < 3.4.0: Affected

    No fix published

  • node-dompurify Debian:12

    Versions
    • 2.4.1+dfsg+~2.4.0-1
    • 2.4.1+dfsg+~2.4.0-2
    • 2.4.1+dfsg+~2.4.0-2+deb12u1
    • 3.0.9+dfsg+~3.0.5-1
    • 3.1.6+dfsg+~3.0.5-1
    • 3.1.7+dfsg+~3.0.5-1
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    • 3.4.1+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    • 3.4.16+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Debian:13

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    • 3.4.1+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    • 3.4.16+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Debian:14

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.2.5+dfsg-1
    • 3.3.2+dfsg-1
    • 3.3.3+dfsg-1
    • 3.3.3+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 3.4.1+dfsg-1

    Update to 3.4.1+dfsg-1

  • dompurify npm

    Affected ranges
    • SEMVER: < 3.4.0

    Update to 3.4.0

  • node-dompurify Ubuntu:22.04:LTS

    Versions
    • 2.3.0+dfsg-2
    • 2.3.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:24.04:LTS

    Versions
    • 2.4.1+dfsg+~2.4.0-1
    • 3.0.9+dfsg+~3.0.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:25.10

    Versions
    • 3.1.7+dfsg+~3.0.5-1
    • 3.1.7+dfsg+~3.0.5-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:26.10

    Versions
    • 3.3.3+dfsg-1
    • 3.4.2+dfsg-1
    • 3.4.5+dfsg-1
    • 3.4.12+dfsg-1
    • 3.4.13+dfsg-1
    • 3.4.13+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dompurify Ubuntu:26.04:LTS

    Versions
    • 3.1.7+dfsg+~3.0.5-2
    • 3.3.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →