1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2145 more potentially affected by CVE-2026-49978 via dompurify (>=3.0.0, <=3.4.6)

🗓️ 15 Jun 2026 20:01:45Reported by Vulners OSVType

Dompurify up to 3.4.6 vulnerable via CVE-2026-49978, affecting 1router, 8router and 2145+ packages through transitive dependency.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: Cyber Fraud includes components with multiple known vulnerabilities	6 Aug 202613:11	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Suite Software includes components with multiple known vulnerabilities	24 Aug 202611:23	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:29	–	ibm
Chainguard	CVE-2026-49978 vulnerabilities	18 Jun 202620:21	–	cgr
Circl	CVE-2026-49978	27 Jul 202603:57	–	circl
CVE	CVE-2026-49978	14 Jul 202620:02	–	cve
Cvelist	CVE-2026-49978 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content	14 Jul 202620:02	–	cvelist
Debian CVE	CVE-2026-49978	14 Jul 202620:02	–	debiancve
EUVD	EUVD-2026-44452	14 Jul 202620:02	–	euvd

15 Jun 2026 20:01Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.16.1

CVSS 46.3

EPSS0.00334

SSVC