Skip to content
OpenAdvisories

Package · npm

happy-dom

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 6.5
    CVE-2026-118661

    Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domai…

    capricorn86 happy-dom happy-dom npm
  • High 8.6
    CVE-2026-118660

    Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePag…

    capricorn86 happy-dom happy-dom npm
  • High 8.8
    CVE-2026-115895

    Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript bin…

    capricorn86 happy-dom happy-dom npm
  • High 7.5
    CVE-2026-34226

    Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "inc…

    capricorn86 happy-dom happy-dom npm
  • High 8.8
    CVE-2026-33943

    Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injec…

    capricorn86 happy-dom happy-dom npm
  • Critical 9.4
    CVE-2025-62410

    --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

    In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers ca…

    capricorn86 happy-dom happy-dom npm
  • High 7.2
    CVE-2025-61927

    Happy-DOM has VM Context Escape

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is no…

    capricorn86 happy-dom happy-dom npm
  • Critical 9.3
    CVE-2024-51757

    Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

    happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised t…

    capricorn86 happy-dom happy-dom npm