CVE-2026-65899 describes a vulnerability in DOMPurify versions >=3.0.0 and <3.4.9 where the clearConfig() method fails to reset the retained Trusted Types policy. Consequently, when a DOMPurify instance is reused across different trust boundaries, it remains bound to the previously supplied TRUSTED_TYPES_POLICY. If a later caller requests RETURN_TRUSTED_TYPE output, they receive a TrustedHTML object created by the old policy rather than a clean default. This behavior can lead to script execution at a Trusted Types sink, undermining the intended protection mechanism. Attempts to clear the policy by passing TRUSTED_TYPES_POLICY: null are ineffective.

The vulnerability can lead to script execution in contexts expecting Trusted Types enforcement, due to the reuse of an outdated and potentially unsafe Trusted Types policy. This undermines the security guarantees of DOMPurify when used across different trust boundaries, potentially allowing cross-site scripting or similar script injection attacks. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited scope and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid reusing DOMPurify instances across trust boundaries or ensure that a new instance is created per trust boundary. Passing TRUSTED_TYPES_POLICY: null does not clear the retained policy and is not an effective mitigation. Monitor vendor communications for an official fix or update.