Critical Vulnerability in node-dompurify: CVE-2026-41240
Summary
DEBIAN-CVE-2026-41240: ... Affects node-dompurify versions 2.4.1+dfsg+~2.4.0-1 – 3.3.3+dfsg-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-Site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering in browsers. The library is designed to allow developers to clean potentially dangerous HTML while preserving safe content. However, recent findings have identified a critical vulnerability that affects multiple Debian versions, potentially exposing applications to security risks.
Vulnerability Detail
CVE-2026-41240 is a vulnerability in the node-dompurify package that allows attackers to exploit the sanitization process, leading to potential XSS attacks. The vulnerability originates from improper handling of certain HTML elements, which could allow malicious scripts to be executed in the context of the user's browser. This could result in unauthorized access to sensitive information, session hijacking, or other malicious activities. The vulnerability affects all versions of node-dompurify prior to the patch.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional input validation and sanitization on user-generated content before passing it to node-dompurify. This can help mitigate the risk of XSS attacks until the package is updated. However, this is not a complete solution and should be used with caution.
Conclusion
The CVE-2026-41240 vulnerability in node-dompurify poses significant risks to web applications that rely on this library for sanitizing HTML content. It is crucial for developers to update to the latest patched version to protect their applications from potential XSS attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2026-41240 is a critical vulnerability in the node-dompurify package that can lead to XSS attacks due to improper sanitization of HTML content.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive user information, session hijacking, and execution of malicious scripts in the user's browser.
Yes, a patched version of node-dompurify is available. It is recommended to update to the latest version to mitigate the risk.
If immediate updates are not possible, consider implementing additional input validation and sanitization as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
