## ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113650
- 公開日時: 2026-10-21T17:05:01.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c9rx-x947-fp3h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c9rx-x947-fp3h

影響: npm:sanitize-html >= 2.18.0, < 2.18.1 → 2.18.1
Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options) (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4: 1. A few kilobytes of unclosed tags throw RangeError: Maximum call stack size exceeded with the default options. Any application that sanitizes un…