Vulnerabilities

TI-2026-82202 CVE-2026-118661 · GHSA-5fpq-26gf-qwcr

Cookie scope forgery in Happy DOM lets attackers set victim cookies

HIGH 68

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00272 Published 2026-10-28 Partial fix · 20.14.6 CWE-565

TI-2026-82201 CVE-2026-118660 · GHSA-c8p4-j97h-3vg8

Server-side request forgery in Happy DOM HTML parser

MEDIUM 43

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00405 Published 2026-10-28 Partial fix · 21.0.0 CWE-918

TI-2026-82200 CVE-2026-118659

Server-side request forgery in Happy DOM server renderer proxy

HIGH 72

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0039 Published 2026-10-28 Fixed in 21.0.2 CWE-918

TI-2026-80004 CVE-2026-115895 · GHSA-834v-8h66-3h79

Code injection in Happy DOM import aliases allows host code execution

HIGH 73

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00473 Published 2026-10-23 Partial fix · 21.0.4 CWE-94

TI-2026-26521 CVE-2026-34226 · GHSA-w4gp-fjgq-3q4g

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

HIGH 72

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00466 Published 2026-03-27 Partial fix · 20.8.9 CWE-201

TI-2026-26294 CVE-2026-33943 · GHSA-6q6h-j7hj-3r64

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

HIGH 76

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00646 Published 2026-03-27 Partial fix · 20.8.8 CWE-94

TI-2025-38677 CVE-2025-62410 · GHSA-qpm2-6cq5-7pq5

--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

HIGH 76

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.0036 Published 2025-10-15 Fixed in 20.0.2 CWE-1321

TI-2025-38276 CVE-2025-61927 · GHSA-37j7-fg3j-429f

Happy-DOM has VM Context Escape

HIGH 65

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00642 Published 2025-10-10 Fixed in 20.0.0 CWE-94

TI-2024-34662 CVE-2024-51757 · GHSA-96g7-g7g9-jxw8

Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

HIGH 81

happy-dom is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00772 Published 2024-11-06 Fixed in 15.10.2 CWE-79

Vulnerabilities

Filters