Skip to content
OpenAdvisories

Vendor

capricorn86

9 known vulnerabilities.

Products

happy-dom 9
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.6
    CVE-2026-118660

    Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePag…

    capricorn86 happy-dom happy-dom npm
  • High 7.5
    CVE-2026-118659

    @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values…

    capricorn86 happy-dom
  • High 8.8
    CVE-2026-115895

    Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript bin…

    capricorn86 happy-dom happy-dom npm
  • High 7.5
    CVE-2026-34226

    Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "inc…

    capricorn86 happy-dom happy-dom npm
  • High 8.8
    CVE-2026-33943

    Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injec…

    capricorn86 happy-dom happy-dom npm
  • High 7.2
    CVE-2025-61927

    Happy-DOM has VM Context Escape

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is no…

    capricorn86 happy-dom happy-dom npm