ROOT-APP-NPM-CVE-2026-65902 CVE-2026-65902 in dompurify - Patched by Root

Root has patched CVE-2026-65902 in the dompurify package for Root:npm. Multiple fixed versions available...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, librechat, gitlab-rails-ce, wazuh-dashboard, nextcloud-server, langfuse, wazuh-dashboard-fips, gitlab-rails-ce-fips...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...

CVE-2026-65902

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2166 more potentially affected by CVE-2026-65902 via dompurify (>=3.0.0, <=3.4.6)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-65902 Source advisory: OSV:GHSA-76MC-F452-CXCM...