# dompurify (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/dompurify Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/dompurify.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 36 vulnerabilities in dompurify (npm): 0 in the last 7 days and 6 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content, was published on 22 October 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 6 - All time: 36 (1 critical, 0 exploited in the wild) ## About dompurify (npm) JavaScript library that sanitizes HTML to prevent XSS attacks. ## Latest dompurify (npm) vulnerabilities - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [DOMPurify SMIL attributeName=href guard bypass in XHTML mode](https://junglewise.ai/threats/dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2) (low, published 22 Oct 2026) - [DOMPurify IN_PLACE mode XSS via rawtext element text content](https://junglewise.ai/threats/dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e) (info, published 5 Oct 2026) - [DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd) (medium, CVSS 4, published 30 Sep 2026) - [CVE-2026-75838: DOMPurify IN_PLACE hook removal XSS via detached subtree](https://junglewise.ai/threats/cve-2026-75838-dompurify-in-place-hook-removal-xss-via-detached-subtree) (medium, CVSS 4, published 18 Aug 2026) - [Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.](https://junglewise.ai/threats/duplicate-advisory-dompurify-custom-element-handling-bypasses-60a6f4bf) (medium, CVSS 6.1, published 24 Jul 2026) - [CVE-2026-66010: DOMPurify hook bypass in CUSTOM_ELEMENT_HANDLING](https://junglewise.ai/threats/cve-2026-66010-dompurify-hook-bypass-in-custom-element-handling) (medium, CVSS 6.1, published 24 Jul 2026) - [CVE-2026-65914: cure53 DOMPurify mutation-XSS via Re-Contextualization](https://junglewise.ai/threats/cve-2026-65914-cure53-dompurify-mutation-xss-via-re-contextualization) (medium, CVSS 4, published 23 Jul 2026) - [CVE-2026-65913: cure53 DOMPurify prototype pollution in USE_PROFILES mode](https://junglewise.ai/threats/cve-2026-65913-cure53-dompurify-prototype-pollution-in-use-profiles-mode) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65912: cure53 DOMPurify URI validation bypass in attributeCheck](https://junglewise.ai/threats/cve-2026-65912-cure53-dompurify-uri-validation-bypass-in-attributecheck) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65911: Cure53 DOMPurify XSS via state leakage in ADD_ATTR and ADD_TAGS](https://junglewise.ai/threats/cve-2026-65911-cure53-dompurify-xss-via-state-leakage-in-add-attr-and-add-tags) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65904: cure53 DOMPurify XSS bypass in IN_PLACE mode via cross-realm nodes](https://junglewise.ai/threats/cve-2026-65904-cure53-dompurify-xss-bypass-in-in-place-mode-via-cross-realm) (medium, CVSS 4.7, published 23 Jul 2026) - [CVE-2026-65903: cure53 DOMPurify logic error in ADD_TAGS function bypasses FORBID_TAGS](https://junglewise.ai/threats/cve-2026-65903-cure53-dompurify-logic-error-in-add-tags-function-bypasses-forbid) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65902: cure53 DOMPurify global allow-list pollution via hook mutation](https://junglewise.ai/threats/cve-2026-65902-cure53-dompurify-global-allow-list-pollution-via-hook-mutation) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65901: cure53 DOMPurify XSS in IN_PLACE mode via nodeName clobbering](https://junglewise.ai/threats/cve-2026-65901-cure53-dompurify-xss-in-in-place-mode-via-nodename-clobbering) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65900: cure53 DOMPurify template expression bypass in DOM output modes](https://junglewise.ai/threats/cve-2026-65900-cure53-dompurify-template-expression-bypass-in-dom-output-modes) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65899: cure53 DOMPurify state contamination in Trusted Types policy](https://junglewise.ai/threats/cve-2026-65899-cure53-dompurify-state-contamination-in-trusted-types-policy) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65898: cure53 DOMPurify allowlist pollution via setConfig](https://junglewise.ai/threats/cve-2026-65898-cure53-dompurify-allowlist-pollution-via-setconfig) (high, CVSS 7.2, published 23 Jul 2026) - [CVE-2026-49978: Cure53 DOMPurify XSS bypass in IN_PLACE sanitization](https://junglewise.ai/threats/cve-2026-49978-cure53-dompurify-xss-bypass-in-in-place-sanitization) (medium, CVSS 4, published 14 Jul 2026) - [CVE-2026-49459: cure53 DOMPurify XSS via DOM Clobbering in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49459-cure53-dompurify-xss-via-dom-clobbering-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-49458: cure53 DOMPurify XSS via cross-realm bypass in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49458-cure53-dompurify-xss-via-cross-realm-bypass-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-47423: cure53 DOMPurify XSS bypass via selectedcontent re-cloning](https://junglewise.ai/threats/cve-2026-47423-cure53-dompurify-xss-bypass-via-selectedcontent-re-cloning) (high, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)](https://junglewise.ai/threats/cve-2026-41240-dompurify-forbid-tags-bypassed-by-function-based-add-tags) (medium, CVSS 6.1, published 23 Apr 2026) - [CVE-2026-41239: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode](https://junglewise.ai/threats/cve-2026-41239-dompurify-has-a-safe-for-templates-bypass-in-return-dom-mode) (medium, CVSS 6.8, published 23 Apr 2026) ## Most severe dompurify (npm) vulnerabilities - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-47423: cure53 DOMPurify XSS bypass via selectedcontent re-cloning](https://junglewise.ai/threats/cve-2026-47423-cure53-dompurify-xss-bypass-via-selectedcontent-re-cloning) (high, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-65898: cure53 DOMPurify allowlist pollution via setConfig](https://junglewise.ai/threats/cve-2026-65898-cure53-dompurify-allowlist-pollution-via-setconfig) (high, CVSS 7.2, published 23 Jul 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-41238: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback](https://junglewise.ai/threats/cve-2026-41238-dompurify-prototype-pollution-to-xss-bypass-via-custom-element) (medium, CVSS 6.9, published 23 Apr 2026) - [CVE-2026-41239: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode](https://junglewise.ai/threats/cve-2026-41239-dompurify-has-a-safe-for-templates-bypass-in-return-dom-mode) (medium, CVSS 6.8, published 23 Apr 2026) - [CVE-2026-65899: cure53 DOMPurify state contamination in Trusted Types policy](https://junglewise.ai/threats/cve-2026-65899-cure53-dompurify-state-contamination-in-trusted-types-policy) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-49458: cure53 DOMPurify XSS via cross-realm bypass in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49458-cure53-dompurify-xss-via-cross-realm-bypass-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-49459: cure53 DOMPurify XSS via DOM Clobbering in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49459-cure53-dompurify-xss-via-dom-clobbering-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-65902: cure53 DOMPurify global allow-list pollution via hook mutation](https://junglewise.ai/threats/cve-2026-65902-cure53-dompurify-global-allow-list-pollution-via-hook-mutation) (medium, CVSS 6.1, published 23 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 50% on the four before (2). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "dompurify (npm) vulnerabilities", https://junglewise.ai/threats/technologies/dompurify, 13 November 2026.