CVE-2026-65911

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

We have discovered 63,423 live websites that are affected by CVE-2026-65911.

Run a Free Instant Scan



Affected Software

Product  DOMPurify
Category JavaScript Libraries
Vulnerable Domains63,423 live websites (100% of DOMPurify install base)
Vulnerable Versions
  • from 0 through 3.4
Vulnerable Versions Count62 versions ( 87% of all versions)



Details

  • Published - Jul 23, 2026
  • Updated - Jul 27, 2026

Credits

  • offset (reporter)

Website Distribution by Country

Number of websites using CVE-2026-65911
United States17,360 websites


Germany8,629 websites
France3,896 websites
Japan2,889 websites
GB2,595 websites
Netherlands2,439 websites
Brazil2,175 websites
Italy1,992 websites
Poland1,841 websites
Switzerland1,558 websites

Website Distribution by TLD

Number of websites using CVE-2026-65911
.com24,139 websites
.de6,004 websites
.org2,817 websites
.nl2,187 websites
.com.br2,019 websites
.fr1,808 websites
.co.uk1,531 websites
.it1,453 websites
.net1,414 websites
.pl1,397 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-65911

Top websites that are affected by CVE-2026-65911. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.*****.com United States*,***
********.org United States*,***
***********.ch Switzerland*,***
*****.com United States*,***
********.org United States*,***
***********.dk Denmark*,***
************.org France*,***
*********.com United States*,***
*************.com United States*,***
*****************.org United States**,***
See full domain list

FAQ

A total of 63,423 websites have been identified as vulnerable to CVE-2026-65911, based on global website indexing conducted by WebTechSurvey.
The DOMPurify is affected by the CVE-2026-65911 vulnerability.
DOMPurify versions up to 3.4 are vulnerable to CVE-2026-65911.
CVE-2026-65911 is resolved in version 3.4 of DOMPurify.