CVE-2026-118661
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Prior to 20.14.6, Happy DOM's CookieContainer does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering applications, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation.
Risk Assessment
In server-side rendering applications, this can lead to forged cookie injection or session fixation, enabling user session hijacking.
Recommendation
Update Happy DOM to version 20.14.6 or later. Consider limiting contact with untrusted origins in SSR applications.
Other vulnerabilities in Happy DOM
See all- CVE-2025-62410Critical
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
- CVE-2026-118660High
Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can cause server-side requests to arbitrary internal or cloud endpoints.
- CVE-2026-115895High
Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.
- CVE-2026-34226High
In Happy DOM library before version 20.8.9, there is a vulnerability where cookies are incorrectly attached when using fetch() with credentials: 'include'. Instead of cookies from the target URL, cookies from the current page origin (window.location) are attached, potentially leaking cookies from origin A to origin B.
- CVE-2026-33943High
A code injection vulnerability in Happy DOM versions 15.10.0 through 20.8.7 allows Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code, and the quote filter fails to strip backticks, enabling template literal-based payloads to bypass sanitization.
- CVE-2025-61927High
Happy DOM version 19 and lower contains a vulnerability allowing remote code execution (RCE). The Node.js VM context is not isolated, allowing untrusted JavaScript code to escape the VM and access process-level functionality. Version 20.0.0 fixes the issue by disabling JavaScript evaluation by default.
Original NVD description (English source)
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS