CVE-2026-65912

DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.

We have discovered 63,260 live websites that are affected by CVE-2026-65912.

Run a Free Instant Scan



Affected Software

Product  DOMPurify
Category JavaScript Libraries
Vulnerable Domains63,260 live websites (99% of DOMPurify install base)
Vulnerable Versions
  • from 0 through 3.3.2
Vulnerable Versions Count60 versions ( 85% of all versions)



Details

  • Published - Jul 23, 2026
  • Updated - Jul 23, 2026

Credits

  • christos-eth (reporter)

Website Distribution by Country

Number of websites using CVE-2026-65912
United States17,234 websites


Germany8,621 websites
France3,895 websites
Japan2,888 websites
GB2,594 websites
Netherlands2,438 websites
Brazil2,174 websites
Italy1,992 websites
Poland1,841 websites
Switzerland1,558 websites

Website Distribution by TLD

Number of websites using CVE-2026-65912
.com24,028 websites
.de5,999 websites
.org2,810 websites
.nl2,186 websites
.com.br2,018 websites
.fr1,807 websites
.co.uk1,531 websites
.it1,453 websites
.net1,411 websites
.pl1,397 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-65912

Top websites that are affected by CVE-2026-65912. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.*****.com United States*,***
********.org United States*,***
***********.ch Switzerland*,***
*****.com United States*,***
********.org United States*,***
***********.dk Denmark*,***
************.org France*,***
*********.com United States*,***
*************.com United States*,***
*****************.org United States**,***
See full domain list

FAQ

A total of 63,260 websites have been identified as vulnerable to CVE-2026-65912, based on global website indexing conducted by WebTechSurvey.
The DOMPurify is affected by the CVE-2026-65912 vulnerability.
DOMPurify versions up to 3.3.2 are vulnerable to CVE-2026-65912.
CVE-2026-65912 is resolved in version 3.3.2 of DOMPurify.