Critical Vulnerability in node-dompurify: CVE-2026-41239 Exposes Applications to Security Risks
Summary
DEBIAN-CVE-2026-41239: ... Affects node-dompurify versions 2.4.1+dfsg+~2.4.0-1 – 3.3.3+dfsg-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-Site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering in browsers. The library is designed to allow developers to clean HTML input while preserving the necessary formatting and structure. However, recent findings have revealed a vulnerability that could potentially compromise the security of applications relying on this package.
Vulnerability Detail
CVE-2026-41239 is a vulnerability identified in node-dompurify that arises from improper handling of certain inputs, which can lead to security breaches. This vulnerability allows attackers to inject malicious scripts into web applications, potentially leading to data theft, session hijacking, or other malicious activities. The issue originates from the library's failure to adequately sanitize specific HTML elements, making it susceptible to exploitation. It is crucial for developers to address this vulnerability promptly to safeguard their applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement additional input validation and sanitization measures in their applications to mitigate the risk. This may involve using alternative libraries or manually filtering user inputs before passing them to node-dompurify. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The discovery of CVE-2026-41239 in node-dompurify highlights the importance of maintaining up-to-date dependencies in web applications. Developers are urged to promptly update their packages to mitigate security risks and ensure the safety of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2026-41239 is a security vulnerability in the node-dompurify package that allows attackers to inject malicious scripts into web applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to data theft, session hijacking, and other malicious activities that compromise user security.
Yes, a patched version of node-dompurify is available. You can update to the latest version using the command: npm install node-dompurify@latest.
If immediate updates are not possible, implement additional input validation and sanitization measures as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
