UpHeron
All vulnerabilities

npm

GHSA-mrv2-3pqr-j5jr

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Severity
High
Published
22 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
23 Oct 2026
Fixed in
3.4.17
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
dompurifynpm · osv:npm:dompurify
  • Every version before 3.4.17

References