CVE-2026-115895
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.
Risk Assessment
An attacker can achieve code execution in the Node.js host process, potentially leading to full application compromise.
Recommendation
Update Happy DOM to version 21.0.4 or later and consider disabling enableJavaScriptEvaluation if not required.
Other vulnerabilities in Happy DOM
See all- CVE-2025-62410Critical
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
- CVE-2026-118661Medium
Prior to 20.14.6, Happy DOM's CookieContainer does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering applications, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation.
- CVE-2026-118660High
Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can cause server-side requests to arbitrary internal or cloud endpoints.
- CVE-2026-34226High
In Happy DOM library before version 20.8.9, there is a vulnerability where cookies are incorrectly attached when using fetch() with credentials: 'include'. Instead of cookies from the target URL, cookies from the current page origin (window.location) are attached, potentially leaking cookies from origin A to origin B.
- CVE-2026-33943High
A code injection vulnerability in Happy DOM versions 15.10.0 through 20.8.7 allows Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code, and the quote filter fails to strip backticks, enabling template literal-based payloads to bypass sanitization.
- CVE-2025-61927High
Happy DOM version 19 and lower contains a vulnerability allowing remote code execution (RCE). The Node.js VM context is not isolated, allowing untrusted JavaScript code to escape the VM and access process-level functionality. Version 20.0.0 fixes the issue by disabling JavaScript evaluation by default.
Original NVD description (English source)
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS