CVE-2026-65912 cure53 CVE debrief

Who should care

Developers and administrators using DOMPurify in their applications should be aware of this vulnerability and take steps to mitigate it. They should review the official CVE record and NVD entry to understand the affected versions and update DOMPurify to version 3.3.2 or later. Furthermore, they should assess their applications for potential exposure, implement compensating controls, and monitor for suspicious activity. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize updating DOMPurify to prevent potential attacks. IT teams responsible for patch management and software updates should ensure that DOMPurify is updated to version 3.3.2 or later to prevent exploitation of this vulnerability. Additionally, operators and maintainers of web applications that utilize DOMPurify should take steps to verify and mitigate this vulnerability to prevent potential security breaches. Those responsible for asset inventory and monitoring should also be aware of the potential impact of this vulnerability on their systems and take steps to detect and prevent DOM-based XSS attacks. Those responsible for change management and rollback/change windows should prioritize updating DOMPurify to version 3.3.2 or later and implement additional security measures to detect and prevent DOM-based XSS attacks. Those responsible for source tracking and incident response should be aware of this vulnerability and take steps to detect and respond to potential attacks. Finally, those responsible for compensating controls and monitoring should implement additional security measures to detect and prevent DOM-based XSS attacks and monitor for suspicious activity. Those responsible for exposure review should assess their applications for potential exposure and prioritize updating DOMPurify to version 3.3.2 or later. Those responsible for vendor patch guidance should prioritize updating DOMPurify to version 3.3.2 or later and provide guidance on mitigating this vulnerability. Those responsible for security teams and vulnerability management teams should prioritize updating DOMPurify to version 3.3.2 or later and implement additional security and IT

Technical summary

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

Defensive priority

Organizations using DOMPurify should prioritize updating to version 3.3.2 or later to address the URI validation bypass vulnerability.

Recommended defensive actions

• Update DOMPurify to version 3.3.2 or later
• Implement additional security measures to detect and prevent DOM-based XSS attacks
• Monitor and review DOMPurify usage in your application
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the URI validation bypass vulnerability in DOMPurify before 3.3.2. The vulnerability allows attackers to bypass URI-safe validation and execute DOM-based XSS when a link is activated. To verify and mitigate this vulnerability, defenders should review the official CVE record and NVD entry for affected versions and update DOMPurify to version 3.3.2 or later. Additionally, defenders should assess their applications for potential exposure, implement compensating controls, and monitor for suspicious activity.

Official resources