Skip to contentCapricorn86 Happy-dom vulnerabilities
- capricorn86 happy-domHappy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesCVE-2026-118661Fix available6.5 Medium
- capricorn86 happy-domHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLCVE-2026-118660Fix available8.6 High
- capricorn86 happy-dom@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open ProxyCVE-2026-1186597.5 High
- capricorn86 happy-domHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionCVE-2026-115895Fix available8.8 High
- capricorn86 happy dom, happy-dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesCVE-2026-34226Fix available7.5 High
- capricorn86 happy-dom, happy dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeCVE-2026-33943Fix available8.8 High
- capricorn86 happy-dom--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domCVE-2025-62410Fix available9.4 Critical
- capricorn86 happy-domHappy-DOM has VM Context EscapeCVE-2025-61927Fix available7.2 High
- capricorn86 happy-domFixes security vulnerability that allowed for server side code to be executed by a <script> tagCVE-2024-51757Fix available9.3 Critical