CVE-2026-65903: DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
DOMPurify before 3.4.0 contains a logic error in the ADDTAGS function where short-circuit evaluation allows forbidden tags to bypass FORBIDTAGS restrictions. Attackers can craft input containing tags listed in FORBIDTAGS that are also added via ADDTAGS function, causing them to be retained in sanitized output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65903?
The severity of CVE-2026-65903 is rated as medium, with a CVSS score of 6.1.
How do I fix CVE-2026-65903?
To fix CVE-2026-65903, upgrade DOMPurify to version 3.4.0 or later.
What is the impact of CVE-2026-65903?
CVE-2026-65903 allows attackers to bypass FORBID_TAGS restrictions, potentially leading to the retention of forbidden HTML tags.
Which versions of DOMPurify are affected by CVE-2026-65903?
DOMPurify versions prior to 3.4.0 are affected by CVE-2026-65903.
What function in DOMPurify is associated with CVE-2026-65903?
The ADD_TAGS function in DOMPurify is associated with CVE-2026-65903.