CVE-2026-34226
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Happy DOM library before version 20.8.9, there is a vulnerability where cookies are incorrectly attached when using fetch() with credentials: 'include'. Instead of cookies from the target URL, cookies from the current page origin (window.location) are attached, potentially leaking cookies from origin A to origin B.
Risk Assessment
The risk involves potential leakage of sensitive session or authentication cookies between different origins, which could allow an attacker to hijack user sessions or access protected resources.
Recommendation
Immediately update the Happy DOM library to version 20.8.9 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Happy DOM
See all- CVE-2025-62410Critical
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
- CVE-2026-118661Medium
Prior to 20.14.6, Happy DOM's CookieContainer does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering applications, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation.
- CVE-2026-118660High
Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can cause server-side requests to arbitrary internal or cloud endpoints.
- CVE-2026-115895High
Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.
- CVE-2026-33943High
A code injection vulnerability in Happy DOM versions 15.10.0 through 20.8.7 allows Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code, and the quote filter fails to strip backticks, enabling template literal-based payloads to bypass sanitization.
- CVE-2025-61927High
Happy DOM version 19 and lower contains a vulnerability allowing remote code execution (RCE). The Node.js VM context is not isolated, allowing untrusted JavaScript code to escape the VM and access process-level functionality. Version 20.0.0 fixes the issue by disabling JavaScript evaluation by default.
Original NVD description (English source)
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS