CVE-2026-65899 cure53 CVE debrief

Who should care

Developers and security teams using DOMPurify 3.0.0 before 3.4.9 should be aware of this vulnerability, as it can lead to script execution at a Trusted Types sink. Affected operator, platform, vulnerability-management, and security-team impact should be considered. Proper use of clearConfig() and TRUSTED_TYPES_POLICY should be reviewed and updated.

Technical summary

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy. The vulnerability can be mitigated by applying the patch or upgrading to DOMPurify 3.4.9 or later.

Defensive priority

Apply the patch or upgrade to DOMPurify 3.4.9 or later to mitigate this vulnerability. Review and update code to ensure proper use of clearConfig() and TRUSTED_TYPES_POLICY. Monitor for potential script execution at Trusted Types sinks.

Recommended defensive actions

• Apply the patch or upgrade to DOMPurify 3.4.9 or later
• Review and update code to ensure proper use of clearConfig() and TRUSTED_TYPES_POLICY
• Monitor for potential script execution at Trusted Types sinks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact and mitigation strategies. Affected product deployments should be confirmed to exist in managed environments, and an owner should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review.

Official resources