DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

Description

In src/purify.ts:1117-1123, ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) bypasses FORBID_TAGS due to short-circuit evaluation.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.3.3
• Patched version(s): 3.4.0

References

• GHSA-39q2-94rc-95cp
• CWE-783

Related Issues

• DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) - CVE-2026-41240
• SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta - Vulnerability
• DOMPurify ADD_ATTR predicate skips URI validation - Vulnerability
• ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function - CVE-2024-9506

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dompurify