Critical mXSS Vulnerability in node-dompurify: A Template Literal Regex Flaw
Summary
CVE-2025-26791: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). Affects node-dompurify across 2 version ranges.
< d18ffcb554e0001748865da03ac75dd7829f0f02
< ec29e65f3675077c1a78e6edcab97f797f004a2e
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular library used for sanitizing HTML and preventing XSS attacks in JavaScript applications. It leverages the DOMPurify library to ensure that user-generated content is safe for rendering in web applications. However, the library is vulnerable to a mutation cross-site scripting (mXSS) issue due to an incorrect regular expression in template literals, which can lead to security breaches if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2025-26791, arises from an incorrect template literal regular expression in DOMPurify versions prior to 3.2.4. This flaw can allow attackers to inject malicious scripts into web applications, leading to potential data theft, session hijacking, or other malicious activities. The issue is particularly concerning as it can be exploited in scenarios where user input is sanitized but not properly validated, allowing for the execution of unintended scripts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize user inputs before they reach the DOMPurify library. This can help mitigate the risk of mXSS attacks. Additionally, avoid using template literals in contexts where user input is involved until the package is updated.
Conclusion
The vulnerability CVE-2025-26791 in node-dompurify poses significant risks due to an incorrect template literal regular expression that can lead to mXSS attacks. It is essential for developers to update to the patched version 3.2.4 or later and consider implementing additional input validation as a temporary measure to protect their applications.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2025-26791 is a vulnerability in the node-dompurify package that can lead to mutation cross-site scripting (mXSS) due to an incorrect regular expression in template literals.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential data theft, session hijacking, and the execution of malicious scripts within your web application, which can compromise user security.
Yes, a patch is available in node-dompurify version 3.2.4 and later. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement input validation and avoid using template literals with user input until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
