CVE-2026-65903: 
JavaScript vulnerability analysis and mitigation

CVE-2026-65903 is a logic error in DOMPurify's ADD_TAGS function that allows forbidden HTML tags to bypass FORBID_TAGS restrictions due to short-circuit evaluation. Affecting all versions of DOMPurify before 3.4.0 (≤ 3.3.3), the flaw enables attackers to craft input where tags listed in FORBID_TAGS are also passed via ADD_TAGS as a function, causing them to be retained in sanitized output. The vulnerability was published on July 23, 2026, and is classified as Moderate severity with a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, VulnCheck).

The root cause is an incorrect comparison (CWE-697) in src/purify.ts at lines 1117–1123, where the tag-check condition uses short-circuit evaluation: !(tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]). When tagCheck(tagName) returns true (i.e., the tag is added via ADD_TAGS as a function / EXTRA_ELEMENT_HANDLING.tagCheck), the entire condition evaluates to false and the element is kept — the FORBID_TAGS[tagName] check is never reached. This is inconsistent with the attribute-side logic at line 1214, where FORBID_ATTR explicitly wins first. Exploitation requires an application to simultaneously configure both ADD_TAGS as a function and FORBID_TAGS, a non-default but legitimate configuration pattern (GitHub Advisory).

Successful exploitation allows an attacker to inject otherwise-forbidden HTML tags into sanitized output, potentially enabling cross-site scripting (XSS) or HTML injection attacks against end users of applications relying on DOMPurify for sanitization. The impact is limited to confidentiality and integrity at the system scope (e.g., session hijacking, credential theft, or DOM manipulation), with no direct availability impact. The vulnerability only manifests in applications using the specific combination of ADD_TAGS as a function and FORBID_TAGS, limiting the affected population to a subset of DOMPurify deployments (GitHub Advisory, VulnCheck).

1. Identify a vulnerable target: Find a web application using DOMPurify ≤ 3.3.3 that is configured with both ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) and FORBID_TAGS containing specific tag names.
2. Craft malicious input: Construct an HTML payload containing a tag that is simultaneously listed in FORBID_TAGS and would be approved by the tagCheck function (e.g., a <script> or other dangerous tag that the custom tagCheck function returns true for).
3. Submit the payload: Deliver the crafted HTML to the application's input field or API endpoint that passes user-supplied content through DOMPurify's sanitize() function with the vulnerable configuration.
4. Bypass sanitization: Due to short-circuit evaluation, tagCheck(tagName) returning true causes the condition to short-circuit, skipping the FORBID_TAGS check and retaining the forbidden tag in the sanitized output.
5. Achieve XSS/HTML injection: The forbidden tag is rendered in the victim's browser, executing attacker-controlled JavaScript or injecting malicious HTML, enabling session hijacking, credential theft, or further attacks (GitHub Advisory).

Upgrade DOMPurify to version 3.4.0 or later, which fixes the logic error by ensuring FORBID_TAGS is evaluated before tagCheck, so forbidden tags always take precedence. As a temporary workaround for applications that cannot immediately upgrade, avoid using ADD_TAGS as a function (i.e., EXTRA_ELEMENT_HANDLING.tagCheck) in combination with FORBID_TAGS; instead, use ADD_TAGS as a static array, which is not affected by this logic flaw. Applications using only one of these two configuration options are not vulnerable (GitHub Advisory).

The vulnerability was disclosed by the cure53 team via a GitHub Security Advisory on April 15, 2026, and assigned a CVE in July 2026. The advisory itself notes the issue is "config-dependent but a genuine logic inconsistency," and the suggested fix was incorporated into DOMPurify 3.4.0. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).