CVE-2026-126205

The Loofah library, a tool for manipulating HTML/XML documents, is vulnerable to a Regular Expression Denial of Service (ReDoS) in its HTML5 sanitizer. Prior to version 2.25.3 , the sanitizer uses a regular expression to check href and xlink:href attributes on elements within SVG_ALLOW_LOCAL_HREF...