Read the docs
TI-2025-38276 Aliases CVE-2025-61927GHSA-37j7-fg3j-429f

Happy-DOM has VM Context Escape

Priority HIGH 65CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00642 51st percentileScored 2026-11-07
Fix Fixed happy-dom (capricorn86): 20.0.0happy-dom (npm): 20.0.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capricorn86happy-dombefore 20.0.020.0.0Patch availableCNA
—happy-dom (npm)before 20.0.020.0.0Patch availableGHSA-37j7-fg3j-429f
  • happy-dom Vendorcapricorn86 Affected before 20.0.0 Fixed in 20.0.0 Patch available CNA
  • happy-dom (npm) Vendor— Affected before 20.0.0 Fixed in 20.0.0 Patch available GHSA-37j7-fg3j-429f

Remediation

  • Fix · CNA happy-dom (capricorn86) Fixed in 20.0.0
  • Fix · GHSA-37j7-fg3j-429f happy-dom (npm) Fixed in 20.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2025:23225 Released 2025-12-15 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.25.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces (RHOSDS) 3.25Fixed RHSA-2025:23225
Not affected: 1 product
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.25

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61927
  2. 2026-10-03 Alias added: GHSA-37j7-fg3j-429f
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 5

  • TI-2024-34662 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag CVSS 4.0CRITICAL 9.3
  • TI-2026-26294 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVSS 3.1CRITICAL 9.8
  • TI-2025-38677 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom CVSS 4.0CRITICAL 9.4
  • TI-2026-80004 Code injection in Happy DOM import aliases allows host code execution CVSS 3.1HIGH 8.8
  • TI-2026-82200 Server-side request forgery in Happy DOM server renderer proxy CVSS 3.1HIGH 7.5
  • TI-2026-26521 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences