CVE-2026-113650: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.18.1
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Applications using npm/sanitize-html version 2.18.0 are affected when they sanitize attacker-controlled HTML with the default behavior: iframe elements are not allowed and disallowedTagsMode is set to discard.
What does an attacker need to exploit it?
An attacker needs the ability to supply HTML that is passed to sanitize-html. No authentication or user interaction is required according to the supplied severity vector.
What is the practical impact?
Specially crafted nested discarded iframe content can trigger unbounded recursive sanitization and cause a stack overflow, resulting in a denial of service.
What should be done if the affected version is deployed?
Update sanitize-html from 2.18.0 to 2.18.1, which fixes the recursion issue. Until updating, avoid sanitizing untrusted HTML that can contain nested iframe fallback content.