Is CVE-2026-65912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65912 being exploited in the wild.

How severe is CVE-2026-65912?

Medium severity, with a CVSS score of 6.1, published 23 July 2026.

Which products and versions are affected?

dompurify (npm) <= 3.3.1, SEMVER:introduced=0,fixed=3.3.2.

Is there a fix for CVE-2026-65912?

Yes. dompurify (npm): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65912 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65912?

Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65912: cure53 DOMPurify URI validation bypass in attributeCheck

Q: Which products and versions are affected?

dompurify (npm) <= 3.3.1, SEMVER:introduced=0,fixed=3.3.2.

Q: Is there a fix for CVE-2026-65912?

Yes. dompurify (npm): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65912 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65912?

Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65912 · Severity: medium · CVSS 6.1 · Published 2026-07-23

DOMPurify, a widely used library for cleaning HTML to prevent security attacks, contains a flaw in how it validates web links. If a developer configures the library with specific custom rules, an attacker can bypass security filters to include malicious 'javascript:' links. If a user clicks one of these links, it could allow the attacker to steal data or perform unauthorized actions in the user's browser session.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-65912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65912 being exploited in the wild.
How severe is CVE-2026-65912?: Medium severity, with a CVSS score of 6.1, published 23 July 2026.
Which products and versions are affected?: dompurify (npm) <= 3.3.1, SEMVER:introduced=0,fixed=3.3.2.
Is there a fix for CVE-2026-65912?: Yes. dompurify (npm): upgrade to 3.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65912 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65912?: Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompurify (npm): upgrade to 3.3.2 or later
```
npm install dompurify@3.3.2
```

Technical details

A vulnerability exists in DOMPurify's _isValidAttribute function when using the EXTRA_ELEMENT_HANDLING.attributeCheck configuration. When a predicate function is provided via ADD_ATTR and returns true, the library short-circuits the attribute validation process, skipping subsequent URI-safe protocol checks. This allows malicious protocols such as 'javascript:' to bypass the sanitizer. An attacker can exploit this to execute DOM-based Cross-Site Scripting (XSS) if they can influence the input being sanitized and the victim interacts with the resulting malicious element (e.g., clicking a link). The issue is resolved in version 3.3.2.

Affected products

cure53 DOMPurify < 3.3.2

Identifiers

CVE-2026-65912
GHSA-cjmm-f4jc-qw8r

Timeline

2026-04-01: advisory: GHSA-cjmm-f4jc-qw8r published by cure53
2026-07-23: disclosed: CVE-2026-65912 published to NVD
2026-07-23: patched: Fix confirmed in version 3.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.