CVE-2026-109344: DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

Q: Which deployments are exposed to this issue?

Deployments using DOMPurify versions 3.4.13 through 3.4.15 are exposed when they use IN_PLACE mode together with afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. The issue concerns markup processed through that configuration.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to be able to supply markup that is sanitized by the affected DOMPurify configuration. The supplied markup can contain on* event handlers inside a wrapper that an after-sanitization hook removes, and exploitation requires victim interaction.

Q: What is the practical impact?

Event handlers can remain armed on the live DOM after the hook detaches their enclosing subtree. If triggered, they can execute script in the victim's origin.

Q: How can I determine whether my application is affected?

Check whether your application uses DOMPurify 3.4.13, 3.4.14, or 3.4.15, invokes sanitize with IN_PLACE mode, and registers afterSanitizeElements or afterSanitizeAttributes hooks that remove or detach DOM subtrees. All of those conditions are relevant to this issue.

Q: What can be done if upgrading is not immediately possible?

Avoid the affected combination of IN_PLACE mode and afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. Update DOMPurify to version 3.4.16 or later when possible.

Published Oct 12, 2026

Updated

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.

Affected Software

1 affected component

npm/dompurify>=3.4.13<3.4.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DOMPurify to a version that resolves this vulnerability.
Fixed in 3.4.16

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using DOMPurify versions 3.4.13 through 3.4.15 are exposed when they use IN_PLACE mode together with afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. The issue concerns markup processed through that configuration.

What does an attacker need to exploit the vulnerability?

An attacker needs to be able to supply markup that is sanitized by the affected DOMPurify configuration. The supplied markup can contain on* event handlers inside a wrapper that an after-sanitization hook removes, and exploitation requires victim interaction.

What is the practical impact?

Event handlers can remain armed on the live DOM after the hook detaches their enclosing subtree. If triggered, they can execute script in the victim's origin.

How can I determine whether my application is affected?

Check whether your application uses DOMPurify 3.4.13, 3.4.14, or 3.4.15, invokes sanitize with IN_PLACE mode, and registers afterSanitizeElements or afterSanitizeAttributes hooks that remove or detach DOM subtrees. All of those conditions are relevant to this issue.

What can be done if upgrading is not immediately possible?

Avoid the affected combination of IN_PLACE mode and afterSanitizeElements or afterSanitizeAttributes hooks that detach subtrees. Update DOMPurify to version 3.4.16 or later when possible.

CVE-2026-109344: DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact?

How can I determine whether my application is affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact?

How can I determine whether my application is affected?

What can be done if upgrading is not immediately possible?