Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113650 · GHSA-c9rx-x947-fp3h

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Risk score
41/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call…
Affected
sanitize-html (npm) >= 2.18.0, < 2.18.1
Fix
Upgrade sanitize-html to 2.18.1 or later.
Exploitation
No known exploitation

Story map

Story map: sanitize-htmlTHE FLAWSTHE FIXCVE-2026-113650ApostropheCMS sanitize-html:unbounded recursion whenre-sanitizing the fallback of a…CVSS 5.3 · EPSS 0%CVE-2026-113654ApostropheCMS sanitize-html:nonTextTags discard regionends early on an implied close…CVSS 5.3 · EPSS 0%CVE-2026-113661ApostropheCMS: IncompleteCVE-2026-53606: `metahttp-equiv=refresh`…CVSS 5.4 · EPSS 0%Upgrade sanitize-html2.18.1or later on your release lineWho is exposedsanitize-html (npm) < 2.18.0YELLOW · PLAN IT INsanitize-htmlApostropheCMS is anopen-source Node.js contentmanagement system, andsanitize-html provides a simpleHTML sanitizer with a clearAPI. Prior to sanitize-html2.18.0, a non-default…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-674 (CWE-674)56 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

sanitize-html: Yellow, plan it in. ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside …

The flaws

  • CVE-2026-113650: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113654: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113661: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs (CVSS 5.4 · EPSS 0%)

The fix

Upgrade sanitize-html: 2.18.1 or later on your release line

Who is exposed: sanitize-html (npm) < 2.18.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
sanitize-htmlnpm>= 2.18.0, < 2.18.12.18.1

References

Original description

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.