DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. (CVE-2026-66010)

In DOMPurify version 3.4.11, when a custom element is allowed via the CUSTOM_ELEMENT_HANDLING.tagNameCheck configuration, the element bypasses the afterSanitizeElements hook. The sanitization function _sanitizeDisallowedNode returns early for allowed custom elements, skipping subsequent sanitization steps including namespace validation and fallback-tag mXSS checks. As a result, sensitive attributes that would normally be stripped by afterSanitizeElements remain on these custom elements. While the preserved attribute values are inert during initial sanitization, they may be re-injected into HTML sinks later, creating a second-order XSS vector. This vulnerability is due to a control flow inconsistency in the sanitization logic and affects versions prior to 3.4.12.

Applications relying on DOMPurify 3.4.11 with CUSTOM_ELEMENT_HANDLING to sanitize HTML and strip sensitive attributes may have those attributes preserved on allowed custom elements. This can lead to second-order cross-site scripting (XSS) if the custom elements later inject these attributes into HTML sinks such as innerHTML. The vulnerability does not allow direct execution of payloads during sanitization but creates a potential security bypass in the sanitization policy.

A patch is available in DOMPurify version 3.4.12 that addresses this issue. Users should upgrade to version 3.4.12 or later to ensure that allowed custom elements are properly sanitized and the afterSanitizeElements hook is applied consistently. No additional mitigation is required if the update is applied.