Read the docs
TI-2025-38677 Aliases CVE-2025-62410GHSA-qpm2-6cq5-7pq5

--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

Priority HIGH 76CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Fix Fixed happy-dom (capricorn86): 20.0.2happy-dom (npm): 20.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capricorn86happy-dombefore 20.0.220.0.2Patch availableCNA
—happy-dom (npm)19.0.0 to before 20.0.220.0.2Patch availableGHSA-qpm2-6cq5-7pq5
  • happy-dom Vendorcapricorn86 Affected before 20.0.2 Fixed in 20.0.2 Patch available CNA
  • happy-dom (npm) Vendor— Affected 19.0.0 to before 20.0.2 Fixed in 20.0.2 Patch available GHSA-qpm2-6cq5-7pq5

Remediation

  • Fix · CNA happy-dom (capricorn86) Fixed in 20.0.2
  • Fix · GHSA-qpm2-6cq5-7pq5 happy-dom (npm) Fixed in 20.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62410
  2. 2026-10-03 Alias added: GHSA-qpm2-6cq5-7pq5

References

Advisory 1

Other 3

  • TI-2024-34662 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag CVSS 4.0CRITICAL 9.3
  • TI-2026-26294 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVSS 3.1CRITICAL 9.8
  • TI-2026-80004 Code injection in Happy DOM import aliases allows host code execution CVSS 3.1HIGH 8.8
  • TI-2026-82200 Server-side request forgery in Happy DOM server renderer proxy CVSS 3.1HIGH 7.5
  • TI-2026-26521 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVSS 3.1HIGH 7.5
  • TI-2026-82202 Cookie scope forgery in Happy DOM lets attackers set victim cookies CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences