---
id: "CVE-2026-113650"
kind: "vulnerability"
aliases: ["CVE-2026-113650", "GHSA-c9rx-x947-fp3h"]
title: "ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)"
severity: "medium"
cvss: 5.300000190734863
epss: 0.003010000102221966
exploited: false
status: "open"
category: "package"
products: [{"name": "sanitize-html", "fixed": ["2.18.1"], "affected": ">= 2.18.0, < 2.18.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-674", "node.js", "npm", "package", "sanitize-html", "user-generated-html"]
not_affected_if: ["no-untrusted-html-input", "version-2.18.1-or-later", "version-below-2.18.0"]
published_at: "2026-10-20T17:17:35+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c9rx-x947-fp3h", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113650", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

sanitize-html 2.18.0 re-sanitizes the text of a discarded unclosed iframe by calling itself recursively with no bound, so a few kilobytes of repeated iframe tags make it throw RangeError: Maximum call stack size exceeded under default options. The same recursion also lets output exceed the configured nestingLimit, so an attacker can crash a sanitizing process or produce deeply nested HTML.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:sanitize-html affected >= 2.18.0, < 2.18.1 fixed 2.18.1

## How to check

Run npm ls sanitize-html and check whether the resolved version is 2.18.0 (affected range is >= 2.18.0, < 2.18.1).
Grep lockfiles for sanitize-html@2.18.0.
Sanitize the input sanitizeHtml('<iframe>'.repeat(2000)) in a test; a RangeError means the vulnerable code path is present.

## Fix

Upgrade sanitize-html to 2.18.1 or later (fixed in 2.18.1).
If upgrading is not possible, pin to 2.17.7, which the report says is not affected.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-c9rx-x947-fp3h
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113650

## From the sources

### Summary

Since 2.18.0, when an `<iframe>` is not allowed and `disallowedTagsMode` is `'discard'` (the defaults),
its raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change
from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state.
Two consequences, both absent from 2.17.7 and 2.17.4:

1. A few kilobytes of unclosed `<iframe>` tags throw `RangeError: Maximum call stack size exceeded`
   with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to
   throw on a small crafted input.
2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth
   count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.

### Affected versions

- 2.18.0 (the current `latest`), and the `main` branch at the time of writing (the recursive call is
  still in `packages/sanitize-html/index.js`, in the `ontext` handler, branch
  `tag === 'iframe' && !tagAllowed(tag) && options.disallowedTagsMode === 'discard'`).
- Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below).

Tested with Node.js v26.7.0.

### Reproduction 1: stack overflow with the default options

```js
const sanitizeHtml = require('sanitize-html');

// with 2.18.0:
sanitizeHtml('<iframe>'.repeat(1000));  // 8,000 chars: returns ''
sanitizeHtml('<iframe>'.repeat(2000));  // 16,000 chars: throws RangeError: Maximum call stack size exceeded
sanitizeHtml('<iframe>'.repeat(20000)); // 160,000 chars: throws RangeError: Maximum call stack size exceeded
```

Results:

| input | 2.17.4 | 2.17.7 | 2.18.0 |
|---|---|---|---|
| `'<iframe>'.repeat(1000)` | ok | ok | ok |
| `'<iframe>'.repeat(2000)` | ok | ok | RangeError |
| `'<iframe>'.repeat(20000)` | ok | ok | RangeError |

The threshold depends on the remaining stack, so it is lower when `sanitizeHtml` is called from an
already deep call stack (for example inside a server-side rendering pass).

### Reproduction 2: `nestingLimit` is bypassed

```js
const sanitizeHtml = require('sanitize-html');

const input = ('<iframe>' + '<b>'.repeat(3)).repeat(50) + 'x';
const out = sanitizeHtml(input, { allowedTags: ['b'], nestingLimit: 3 });
// maximum nesting depth of <b> in `out`:
//   2.17.4: 2    2.17.7: 0 (fallback escaped as text)    2.18.0: 150
```

Without an iframe, the same options cap the output at three nested `<b>` in all three versions. With
`k` repetitions of `'<iframe>' + '<b>'.repeat(3)`, 2.18.0 returns `3 * k` nested `<b>` (measured for
k = 1, 5, 50: depth 3, 15, 150).

### Cause

In 2.18.0 the `ontext` handler does:

```js
} else if (
  tag === 'iframe' &&
  !tagAllowed(tag) &&
  options.disallowedTagsMode === 'discard'
) {
  result += sanitizeHtml(text, options);
}
```

Because htmlparser2 treats `<iframe>` as a raw-text element, the text of an unclosed iframe is the whole
remainder of the input; re-parsing it can meet another unclosed `<iframe>`, and so on, one stack frame
(and one full re-parse) per iframe. The nested call also starts with its own `depth`, so tags inside the
fallback are not counted against `nestingLimit` together with the enclosing tags.

### Possible directions

Not a patch, only what would close both effects: bound the recursion (or process the fallback without
recursing), and carry the current depth into the nested sanitization so that `nestingLimit` applies to
the whole output.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_