ROOT-APP-NPM-CVE-2026-65903 CVE-2026-65903 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-65903 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: librechat, nextcloud-server, kibana, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, wazuh-dashboard, langfuse-fips...

CVE-2026-65903

DOMPurify before 3.4.0 contains a logic error in the ADDTAGS function where short-circuit evaluation allows forbidden tags to bypass FORBIDTAGS restrictions. Attackers can craft input containing tags listed in FORBIDTAGS that are also added via ADDTAGS function, causing them to be retained in...