CVE-2026-63670

CVE-2026-63670 exposes a parsing-context bypass in sanitize-html that fundamentally undermines what the library's API promises. When you add `<textarea>` or `<xmp>` to allowedTags, htmlparser2 emits the literal `/` after the closing tag as text. Browsers then re-parse the following content as HTML, causing `</textarea><img src=x onerror=alert(1)>` to collapse into executable markup. The bypass isn't a logic error—it's an emergent interaction between three parsing systems (sanitize-html, htmlparser2, and the browser) that no single declarative instruction can capture. The immediate action: audit your sanitize-html configurations and remove `<textarea>`, `<xmp>`, `<listing>`, and `<plaintext>` from allowedTags unless you have a specific, documented requirement to handle legacy content containing these elements. If you must allow them, treat the downstream output as potentially unsafe regardless of other sanitization logic—the parser context creates a structural bypass that tag-level filtering cannot prevent. The deeper problem is architectural. sanitize-html exposes a flat allowlist that cannot express "this tag changes how subsequent content is parsed." The raw-text parsing modes in these elements predate modern HTML5—they were holdovers from early browsers that treated certain elements as opaque CDATA containers. The knowledge of how they behave has effectively decayed from institutional memory, making it unreasonable to expect developers to anticipate this interaction. The library has information about these elements' special handling that the API cannot meaningfully surface. This isn't a patch-and-move-on vulnerability. It represents a ceiling on what declarative allowlists can achieve against parser quirks. If you maintain systems using sanitize-html, treat raw-text elements as deprecated-in-practice for security purposes, even if the library doesn't enforce that. The fix may add combination-aware handling for specific dangerous pairs, but that pattern—blocking dangerous tag combinations reactively—has produced three decades of bypass archaeology in email sanitizers, WAFs, and HTML purifiers. Each special case creates new interaction surface. The long-term play is architectural: move toward sanitization approaches that model parsing context as a first-class concern rather than an edge case.

Reviewed through automated stages and approved by a human before publication.