CVE-2026-65899

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

CVE-2026-65899

The CVE affects DOMPurify 3.0.0 through 3.4.8, where clearConfig() does not reset the retained TRUSTED_TYPES_POLICY. This allows a DOMPurify instance reused across trust boundaries to remain bound to a previously supplied policy, so a later caller requesting RETURN_TRUSTED_TYPE output may receive...

CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...