happy-dom vulnerabilities (npm)
8 vulnerabilities.
-
happy-domnpm Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies 6.5 Medium -
happy-domnpm Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML 8.6 High -
happy-domnpm Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution 8.8 High -
happy-domnpm Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies 7.5 High -
happy-domnpm Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code 8.8 High -
happy-domnpm --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom 9.4 Critical -
happy-domnpm Happy-DOM has VM Context Escape 7.2 High -
happy-domnpm Fixes security vulnerability that allowed for server side code to be executed by a <script> tag 9.3 Critical