npmPackage

happy-dom

8 known vulnerabilities (2 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 21.0.4 (Oct 20, 2026): no advisory affects it
Newest unaffected release: 21.0.4 (Oct 20, 2026), the latest release
Advisories: 8 · 2 critical, 5 high, 1 medium

Weekly downloads: 32.2M
Dependents: 131
Releases: 500+ since 7.5.12 (Oct 14, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-118661
Affects 7.5.12 to 20.14.5 (20.14.6 is outside it)
CVE-2026-118660
Affects 7.5.12 to 20.14.6 (21.0.0 is outside it)
CVE-2026-115895
Affects 17.0.0 to 21.0.3 (21.0.4 is outside it)
CVE-2026-34226
Affects 7.5.12 to 20.8.8 (20.8.9 is outside it)
CVE-2026-33943
Affects 15.10.0 to 20.8.7 (20.8.8 is outside it)
CVE-2025-62410
Affects 19.0.0 to 20.0.1 (20.0.2 is outside it)
CVE-2025-61927
Affects 7.5.12 to 19.0.2 (20.0.0 is outside it)
CVE-2024-51757
Affects 7.5.12 to 15.10.1 (15.10.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 8

CVE-2026-118661Medium 6.5
Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Affected: fixed in 20.14.6.
Fixed in 20.14.6 (released Oct 8, 2026, 20 days before disclosure).
The latest release, 21.0.4, is not affected.
54% of happy-dom downloads last week were affected versions (18.6M).
CVE-2026-118660High 8.6
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Affected: fixed in 21.0.0.
Fixed in 21.0.0 (released Oct 11, 2026, 17 days before disclosure).
The latest release, 21.0.4, is not affected.
62% of happy-dom downloads last week were affected versions (21.1M).
CVE-2026-115895High 8.8
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Affected: from 17.0.0, fixed in 21.0.4.
Fixed in 21.0.4 (released Oct 20, 2026, 3 days before disclosure).
The latest release, 21.0.4, is not affected.
58% of happy-dom downloads last week were affected versions (19.9M).
CVE-2026-34226High 7.5
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
Affected: fixed in 20.8.9.
Fixed in 20.8.9 (released Mar 26, 2026, 1 day before disclosure).
The latest release, 21.0.4, is not affected.
15% of happy-dom downloads last week were affected versions (5.1M).
CVE-2026-33943High 8.8
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Affected: from 15.10.0, fixed in 20.8.8.
Fixed in 20.8.8 (released Mar 24, 2026, 3 days before disclosure).
The latest release, 21.0.4, is not affected.
13% of happy-dom downloads last week were affected versions (4.5M).
CVE-2025-62410Critical 9.4
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
Affected: from 19.0.0, fixed in 20.0.2.
Fixed in 20.0.2 (released Oct 15, 2025, the day of disclosure).
The latest release, 21.0.4, is not affected.
0.2% of happy-dom downloads last week were affected versions (80.4K).
CVE-2025-61927High 7.2
Happy-DOM has VM Context Escape
Affected: fixed in 20.0.0.
Fixed in 20.0.0 (released Oct 9, 2025, 1 day before disclosure).
The latest release, 21.0.4, is not affected.
9.2% of happy-dom downloads last week were affected versions (3.1M).
CVE-2024-51757Critical 9.3
Fixes security vulnerability that allowed for server side code to be executed by a <script> tag
Affected: fixed in 15.10.2.
Fixed in 15.10.2 (released Nov 6, 2024, the day of disclosure).
The latest release, 21.0.4, is not affected.
1.6% of happy-dom downloads last week were affected versions (534.6K).