CVE-2026-34226

HighCVSS 7.5

Published: 27/03/2026(UTC)Updated: 19/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

In Happy DOM library before version 20.8.9, there is a vulnerability where cookies are incorrectly attached when using fetch() with credentials: 'include'. Instead of cookies from the target URL, cookies from the current page origin (window.location) are attached, potentially leaking cookies from origin A to origin B.

Risk Assessment

The risk involves potential leakage of sensitive session or authentication cookies between different origins, which could allow an attacker to hijack user sessions or access protected resources.

Recommendation

Immediately update the Happy DOM library to version 20.8.9 or later, which contains the fix for this vulnerability.

Other vulnerabilities in Happy DOM

CVE-2026-33943High
A code injection vulnerability in Happy DOM versions 15.10.0 through 20.8.7 allows Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code, and the quote filter fails to strip backticks, enabling template literal-based payloads to bypass sanitization.

Original NVD description (English source)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.