CVE-2026-65903 is a logic flaw in DOMPurify before version 3.4.0 where the ADD_TAGS function's short-circuit evaluation causes forbidden tags specified in FORBID_TAGS to be retained in sanitized output. Attackers can exploit this by including tags that are both forbidden and added via ADD_TAGS, bypassing the intended tag filtering mechanism. This undermines the sanitization process, potentially allowing unsafe tags to persist in the output.

The vulnerability allows forbidden HTML tags to bypass DOMPurify's sanitization filters, potentially leading to unsafe content being retained in sanitized output. This could increase the risk of injection of malicious HTML elements, affecting the security of applications relying on DOMPurify for input sanitization. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when relying on DOMPurify versions prior to 3.4.0 for sanitizing untrusted input, and consider alternative sanitization methods or additional filtering controls.