CVE-2026-116803: DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

Q: Which uses of the library are exposed?

Deployments using DOMPurify before 3.4.17 are affected when an IN_PLACE hook removes a parent or sibling node during sanitization of attacker-controlled markup. Detached subtrees created this way may not be walked or have their event handlers neutralized.

Q: What does an attacker need to exploit this issue?

An attacker needs a way to supply markup that is passed to DOMPurify under the affected IN_PLACE hook behavior. The supplied detached subtree can retain an event handler, such as an img onerror handler, that fires after sanitize() returns.

Q: What should be done if an immediate upgrade is not possible?

Avoid using IN_PLACE hooks that remove parent or sibling nodes while sanitizing untrusted markup. Upgrade DOMPurify to version 3.4.17 or later when possible.

Q: How can I determine whether an application is affected?

Check whether the application uses a DOMPurify version earlier than 3.4.17 and review its sanitization hooks. The relevant condition is an IN_PLACE hook that removes a parent or sibling node during processing of untrusted HTML.

Published Oct 26, 2026

Updated

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

Affected Software

1 affected component

npm/dompurify<3.4.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DOMPurify to a version that resolves this vulnerability.
Fixed in 3.4.17

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which uses of the library are exposed?

Deployments using DOMPurify before 3.4.17 are affected when an IN_PLACE hook removes a parent or sibling node during sanitization of attacker-controlled markup. Detached subtrees created this way may not be walked or have their event handlers neutralized.

What does an attacker need to exploit this issue?

An attacker needs a way to supply markup that is passed to DOMPurify under the affected IN_PLACE hook behavior. The supplied detached subtree can retain an event handler, such as an img onerror handler, that fires after sanitize() returns.

What should be done if an immediate upgrade is not possible?

Avoid using IN_PLACE hooks that remove parent or sibling nodes while sanitizing untrusted markup. Upgrade DOMPurify to version 3.4.17 or later when possible.

How can I determine whether an application is affected?

Check whether the application uses a DOMPurify version earlier than 3.4.17 and review its sanitization hooks. The relevant condition is an IN_PLACE hook that removes a parent or sibling node during processing of untrusted HTML.

CVE-2026-116803: DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

Affected Software

Remediation

Event History

Frequently Asked Questions

Which uses of the library are exposed?

What does an attacker need to exploit this issue?

What should be done if an immediate upgrade is not possible?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which uses of the library are exposed?

What does an attacker need to exploit this issue?

What should be done if an immediate upgrade is not possible?

How can I determine whether an application is affected?