I have done some research and found out CSP does block client side prototype pollution based XSS: XSS with CSP bypass. Similarly, DOM XSS case was different. When I used this code, saved at example.html
<!DOCTYPE html>
<html>
<head>CSP</head>
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'">
<body>
<script>eval(document.location.hash.slice(1))</script>
<h1>CSP</h1>
</body>
</html>
This payload popped alert(1): https://ba0c7a11a30b.ngrok.io/example.html#alert(1)
but when I used this code, saved as example.php
<?php
header("content-security-policy: default-src 'none'; script-src 'self' 'unsafe-hashes';")
?>
<!DOCTYPE html>
<html>
<head>CSP</head>
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
<meta http-equiv="Content-Security-Policy" content="default-src https:">
<body>
<script>eval(document.location.hash.slice(1))</script>
<h1>CSP</h1>
</body>
</html>
it didnt result in alert(1). So I would say in most cases CSP mitigates DOM XSS and prototype pollution based xss.