diff --git a/packages/web-app-files/package.json b/packages/web-app-files/package.json
index 909b38a5e68..ced3ce71766 100644
--- a/packages/web-app-files/package.json
+++ b/packages/web-app-files/package.json
@@ -17,7 +17,7 @@
     "@uppy/core": "5.2.0",
     "@vueuse/core": "^11.0.0 || ^12.0.0 || ^13.0.0 || ^14.0.0",
     "axios": "1.15.0",
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.3",
     "email-validator": "^2.0.4",
     "fuse.js": "7.3.0",
     "lodash-es": "4.18.1",
diff --git a/packages/web-pkg/package.json b/packages/web-pkg/package.json
index c930fddd457..1d87cdaa9ae 100644
--- a/packages/web-pkg/package.json
+++ b/packages/web-pkg/package.json
@@ -53,7 +53,7 @@
     "@vueuse/core": "^14.3.0",
     "axios": "^1.13.6",
     "deepmerge": "^4.3.1",
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.3",
     "emoji-regex": "^10.6.0",
     "filesize": "^11.0.17",
     "fuse.js": "^7.3.0",
diff --git a/packages/web-runtime/package.json b/packages/web-runtime/package.json
index ee24924db3c..b21f9807905 100644
--- a/packages/web-runtime/package.json
+++ b/packages/web-runtime/package.json
@@ -25,7 +25,7 @@
     "axios": "1.15.0",
     "deepmerge": "4.3.1",
     "email-validator": "2.0.4",
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.3",
     "focus-trap-vue": "^4.1.0",
     "focus-trap": "8.2.0",
     "fuse.js": "7.3.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f48db10b374..968d580c41f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -634,8 +634,8 @@ importers:
         specifier: 1.15.0
         version: 1.15.0(debug@4.4.3)
       dompurify:
-        specifier: ^3.4.2
-        version: 3.4.2
+        specifier: ^3.4.3
+        version: 3.4.3
       email-validator:
         specifier: ^2.0.4
         version: 2.0.4
@@ -960,8 +960,8 @@ importers:
         specifier: ^4.3.1
         version: 4.3.1
       dompurify:
-        specifier: ^3.4.2
-        version: 3.4.2
+        specifier: ^3.4.3
+        version: 3.4.3
       emoji-regex:
         specifier: ^10.6.0
         version: 10.6.0
@@ -1118,8 +1118,8 @@ importers:
         specifier: 4.3.1
         version: 4.3.1
       dompurify:
-        specifier: ^3.4.2
-        version: 3.4.2
+        specifier: ^3.4.3
+        version: 3.4.3
       email-validator:
         specifier: 2.0.4
         version: 2.0.4
@@ -4301,8 +4301,8 @@ packages:
     resolution: {integrity: sha512-IGBwjF7tNk3cwypFNH/7bfzBcgSCbaMOD3GsaY1AU/JRrnHnYgEM0+9kQt52iZxjNsjBtJYtao146V+f8jFZNw==}
     engines: {node: '>=10'}
 
-  dompurify@3.4.2:
-    resolution: {integrity: sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==}
+  dompurify@3.4.3:
+    resolution: {integrity: sha512-VVwJidIJcp1hpg2OMXML3ZVRPYSZiq4aX7qBh83BSIpOaRDqI+qxhXjjIWnpzkOXhmp0L81lnoME1mnCc9H48A==}
 
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
@@ -10978,7 +10978,7 @@ snapshots:
 
   domain-browser@4.22.0: {}
 
-  dompurify@3.4.2:
+  dompurify@3.4.3:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -12340,7 +12340,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.20
-      dompurify: 3.4.2
+      dompurify: 3.4.3
       es-toolkit: 1.46.1
       katex: 0.16.45
       khroma: 2.1.0