Fixes security vulnerability that allowed for server side code to be executed by a <script> tag
Priority HIGH 81CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-94.
Summary
happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Fixed happy-dom (capricorn86): 15.10.2happy-dom (npm): 15.10.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| capricorn86 | happy-dom | before 15.10.2 | 15.10.2 | Patch available | CNA |
| — | happy-dom (npm) | before 15.10.2 | 15.10.2 | Patch available | GHSA-96g7-g7g9-jxw8 |
- happy-dom Vendorcapricorn86 Affected before 15.10.2 Fixed in 15.10.2 Patch available CNA
- happy-dom (npm) Vendor— Affected before 15.10.2 Fixed in 15.10.2 Patch available GHSA-96g7-g7g9-jxw8
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:capricorn86:happy-dom:*:*:*:*:*:*:*:* | — | — | capricorn86 |
- cpe:2.3:a:capricorn86:happy-dom:*:*:*:*:*:*:*:* Versions — — ·capricorn86
Remediation
- Fix · CNA happy-dom (capricorn86) Fixed in 15.10.2
- Fix · GHSA-96g7-g7g9-jxw8 happy-dom (npm) Fixed in 15.10.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-51757
- 2026-10-03 Alias added: GHSA-96g7-g7g9-jxw8
References
Other 7
- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8
- https://github.com/capricorn86/happy-dom/issues/1585
- https://github.com/capricorn86/happy-dom/pull/1586
- https://github.com/capricorn86/happy-dom/commit/5ee0b1676d4ce20cc2a70d1c9c8d6f1e3f57efac
- https://github.com/capricorn86/happy-dom/commit/d23834c232f1cf5519c9418b073f1dcec6b2f0fd
- https://github.com/capricorn86/happy-dom/releases/tag/v15.10.2
- https://github.com/capricorn86/happy-dom
More capricorn86 vulnerabilities
- TI-2026-26294 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVSS 3.1CRITICAL 9.8
- TI-2025-38677 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom CVSS 4.0CRITICAL 9.4
- TI-2026-80004 Code injection in Happy DOM import aliases allows host code execution CVSS 3.1HIGH 8.8
- TI-2026-82200 Server-side request forgery in Happy DOM server renderer proxy CVSS 3.1HIGH 7.5
- TI-2026-26521 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVSS 3.1HIGH 7.5
- TI-2026-82202 Cookie scope forgery in Happy DOM lets attackers set victim cookies CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-51757 · CVE Program
- CVE-2024-51757 · NVD
- FIRST EPSS
- GHSA-96g7-g7g9-jxw8 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-51757 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences