Is CVE-2026-65903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65903 being exploited in the wild.

How severe is CVE-2026-65903?

Medium severity, with a CVSS score of 6.1, published 23 July 2026.

Which products and versions are affected?

dompurify (npm) <= 3.3.3, SEMVER:introduced=0,fixed=3.4.0.

Is there a fix for CVE-2026-65903?

Yes. dompurify (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65903 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65903?

Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65903: cure53 DOMPurify logic error in ADD_TAGS function bypasses FORBID_TAGS

Q: Which products and versions are affected?

dompurify (npm) <= 3.3.3, SEMVER:introduced=0,fixed=3.4.0.

Q: Is there a fix for CVE-2026-65903?

Yes. dompurify (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65903 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65903?

Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65903 · Severity: medium · CVSS 6.1 · Published 2026-07-23

DOMPurify is a widely-used HTML sanitizer library that removes potentially malicious content from user-supplied HTML. When configured with both the ADD_TAGS and FORBID_TAGS settings simultaneously, a logic flaw causes forbidden tags to be incorrectly allowed through due to short-circuit evaluation in the condition checking. An attacker who can inject HTML into a page using a vulnerable application could bypass tag restrictions and potentially inject malicious scripts or other harmful content.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-65903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65903 being exploited in the wild.
How severe is CVE-2026-65903?: Medium severity, with a CVSS score of 6.1, published 23 July 2026.
Which products and versions are affected?: dompurify (npm) <= 3.3.3, SEMVER:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2026-65903?: Yes. dompurify (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65903 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65903?: Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.4.0 or later
```
npm install dompurify@3.4.0
```

Technical details

The vulnerability exists in src/purify.ts lines 1117–1123, where tag handling uses the condition: !(tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]). When tagCheck(tagName) returns true, the negation makes the entire left side false, short-circuiting the AND operator and preventing FORBID_TAGS[tagName] from being evaluated. This means tags added via the tagCheck function bypass the forbidden-tags list entirely. The root cause is a logic ordering issue: the code checks the user-defined tagCheck callback before consulting FORBID_TAGS, whereas on the attribute side (line 1214), FORBID_ATTR is checked first with an explicit continue statement. Attack preconditions require an application to configure DOMPurify with both ADD_TAGS as a function and FORBID_TAGS simultaneously. An attacker injecting HTML into such an application could craft tag payloads that pass the tagCheck function and bypass FORBID_TAGS restrictions. The fix is to reorder the check: evaluate FORBID_TAGS first and deny the tag before checking tagCheck. This issue was patched in version 3.4.0.

Affected products

Cure53 DOMPurify <= 3.3.3

Identifiers

CVE-2026-65903
GHSA-39q2-94rc-95cp

Timeline

2026-04-16: disclosed: Advisory GHSA-39q2-94rc-95cp published
2026-04-16: patched: Fixed in version 3.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.