Happy DOM Flaws Enable Code Execution, Cookie Forgery, And SSRF

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in happy-dom, a JavaScript DOM implementation used for server-side rendering, testing, and HTML processing. The issues affect module compilation, cookie handling, and external resource loading, creating risks of host code execution, cookie scope forgery, and server-side request forgery. Reported affected ranges include versions from 17.0.0 through 21.0.3 and versions through 20.14.6. Overall, applications that process untrusted HTML or module source with JavaScript evaluation enabled are at elevated risk.

CVE-2026-115895 (CVSS 8.8 — High): The ESM compiler in happy-dom does not validate imported local binding aliases before inserting them into generated JavaScript. An attacker who can supply module source can transform invalid import syntax into executable code and reach host capabilities when JavaScript evaluation is enabled.[emaillocker id="1283"]

CVE-2026-33943 (CVSS 8.8 — High): The ESM compiler in happy-dom allowed an attacker-controlled local export declaration to inject an expression into generated JavaScript. This can enable host code execution when untrusted module source is processed with JavaScript evaluation enabled.

CVE-2026-118661 (CVSS 6.5 — Medium): The cookie handling in happy-dom matches a domain attribute without enforcing a DNS-label boundary, allowing an attacker origin to set cookies that a victim origin later receives. This diverges from browser cookie scoping and can affect server-side rendering or prerendering workflows that process attacker-controlled content.

CVE-2026-118660 (CVSS 8.6 — High): happy-dom makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing iframe or stylesheet elements. An attacker who can supply HTML can trigger requests to internal services or metadata endpoints, enabling server-side request forgery.

These vulnerabilities collectively present a significant risk to server-side applications that parse untrusted HTML or module source. The most exposed environments are those that evaluate JavaScript, handle cookies, or load external resources from attacker-influenced content. Exposure should be assessed to determine whether such processing occurs in production contexts.

RECOMMENDATION:

We recommend you to update happy-dom to version 20.14.6, 21.0.0, or 21.0.4.

REFERENCES:

The following reports contain further technical details:

• https://github.com/advisories/GHSA-c8p4-j97h-3vg8
• https://github.com/advisories/GHSA-834v-8h66-3h79
• https://github.com/advisories/GHSA-5fpq-26gf-qwcr