Hi,

The following vulnerabilities were published for node-dompurify.

CVE-2026-116802[0]:
| DOMPurify before 3.4.17 contains a cross-site scripting
| vulnerability that allows attackers to bypass the SMIL
| attributeName=href guard when PARSER_MEDIA_TYPE is
| application/xhtml+xml, because transformCaseFunc does not lowercase
| attribute names. Attackers can submit SVG with an animate or set
| element using attributeName="href" and a javascript: entry in values
| to execute script when users click the sanitized link.


CVE-2026-116803[1]:
| DOMPurify before 3.4.17 contains a cross-site scripting
| vulnerability that allows attackers to keep event handlers armed
| when an IN_PLACE hook removes a parent or sibling node. Attacker
| markup in detached subtrees is never walked or neutralized, so
| handlers like img onerror fire after sanitize() returns, causing DOM
| XSS.


CVE-2026-116804[2]:
| DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES
| bypass that lets attackers preserve template expressions in attached
| shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE
| modes. Attackers can split expressions across text nodes separated
| by disallowed elements, which merge after removal and are evaluated
| by downstream template engines for cross-site scripting.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116802
https://www.cve.org/CVERecord?id=CVE-2026-116802
[1] https://security-tracker.debian.org/tracker/CVE-2026-116803
https://www.cve.org/CVERecord?id=CVE-2026-116803
[2] https://security-tracker.debian.org/tracker/CVE-2026-116804
https://www.cve.org/CVERecord?id=CVE-2026-116804

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
node-dompurify, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152298@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-dompurify package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 27 Oct 2026 20:13:31 +0100
Source: node-dompurify
Architecture: source
Version: 3.4.17+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1152298
Changes:
 node-dompurify (3.4.17+dfsg-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version
     (Closes: #1152298: CVE-2026-116802 CVE-2026-116803 CVE-2026-116804)
Checksums-Sha1:
 8789fb0c67fcf55f6ce386a7fd1aff061d38849a 2297 node-dompurify_3.4.17+dfsg-1.dsc
 5cb821ad2ef3acf0ef5c1eba19e0ee793baadc60 263448 node-dompurify_3.4.17+dfsg.orig.tar.xz
 2c0eca7f696d2c3af419bfe668b9cc2dc802d90d 37248 node-dompurify_3.4.17+dfsg-1.debian.tar.xz
Checksums-Sha256:
 791ba22e7025b7b7d3b1420b5f7eb94098deeac732d79dfaf97e0e5dcc000919 2297 node-dompurify_3.4.17+dfsg-1.dsc
 f050f1a96c8c3fcda186fc333b3586acab28ab88408eaa3ccd0b7e1ea1aa83d8 263448 node-dompurify_3.4.17+dfsg.orig.tar.xz
 a58d8f20c743b8410e91b8b11ac158b845fe54f812e4eee8679fac406ad88bb6 37248 node-dompurify_3.4.17+dfsg-1.debian.tar.xz
Files:
 251a5e64eee99ed88a3aeb760732c770 2297 javascript optional node-dompurify_3.4.17+dfsg-1.dsc
 421b35683911a7b8d35cd80243f4d282 263448 javascript optional node-dompurify_3.4.17+dfsg.orig.tar.xz
 8c0a31981bcdf739dc8ea60b90c6de57 37248 javascript optional node-dompurify_3.4.17+dfsg-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrg+EcACgkQ9tdMp8mZ
7ukd8xAAlETwqlU+w8U3wcO2qc6ZjfMvtkAbQNsC1D4MZEjQrvzNNcWE8nb/Rbae
PlSO0YU7k2+o6MzgMGyGaX6t4t99j+K3s6Kov0UesulmDXWutkgzmk+rthExC5nh
al+n8t8rmI1mk5hnU1cM3hSsxv7/4MviG50USFAgvREsYEEFpK0zz39j++8ueEJ4
y94R/fzrebICAovAnealgr+ZUC133AFZM+5HCtIyo/D2swh7ZGbTsJ2sAaBTMsrU
4dR0hkZJQ2bZiRu7zRuyIFDCl7egrCNn0p1GW8YHLToVMY/C49iZtW5xjZktaZF7
/8pdfq3E+ya1zJMuRNMbTL9CwNYhPCoYlwXKgfLD3uFk17ApQ653WO2n9pYuPtd9
IOlmBIk9hSCw/80kG9iYgq4bBd40RctbATOLlZNuD4xdNnYIaQBtE4oVy/9Si0nQ
MYYfJPpWVb+9DVCDcZlWJAXnDFOkmlusy7MTJ+ip4QwYR9DnSryWhuiS2FaD3AgR
KEfV1q2Ve4GONzJHRxVohAvXPbmuIzRjiXrvw7nUOCcItlQ4QcWGtv5/AlvP26yp
y4xMApnG/C66DUPsCiN+a9cQA7P6LBj6CmsKePm0qvnmZ3gdcgBhAyW6Qgog9bbC
wB64vUp3XALBjT/9YYNJ1hfRA/zqyU5Y2ocTS73sNAhV/xKJYvw=
=8Z/C
-----END PGP SIGNATURE-----