CVE-2026-41240: DOMPurify Vulnerability Allows Bypass of FORBID_TAGS with Function-Based ADD_TAGS
Summary
CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix). Affects dompurify versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-Site Scripting) attacks. It allows developers to specify which HTML tags and attributes are permitted in user-generated content, making it a critical tool for web security. However, a recent vulnerability has been identified that affects its handling of forbidden tags when function-based predicates are used.
Vulnerability Detail
The vulnerability arises from an inconsistency in how DOMPurify handles FORBID_TAGS compared to FORBID_ATTR when function-based ADD_TAGS predicates are employed. Specifically, the code allows certain forbidden tags to bypass sanitization due to short-circuit evaluation in the tag-checking logic. This can lead to the injection of malicious elements, such as iframes or forms, which can contain harmful URLs or scripts. The issue stems from a lack of an early exit for FORBID_TAGS, unlike the handling for FORBID_ATTR, which correctly prevents forbidden attributes from being retained.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install dompurify@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using function-based predicates for ADD_TAGS if you need to enforce FORBID_TAGS. Instead, use static arrays for allowed and forbidden tags. For example:
const DOMPurify = createDOMPurify(window);
DOMPurify.sanitize('<iframe src="https://evil.com"></iframe>', { FORBID_TAGS: ['iframe'] });
Conclusion
In summary, the DOMPurify vulnerability identified as CVE-2026-41240 poses a risk of bypassing forbidden tags due to inconsistent handling in the library. It is crucial for developers to update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for dompurify →
FAQ
The vulnerability allows certain forbidden HTML tags to bypass sanitization due to improper handling in the DOMPurify library.
Versions prior to 3.4.0 are affected by this vulnerability.
If exploited, this vulnerability can lead to XSS attacks, allowing attackers to inject malicious content into web applications.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
