# happy-dom (npm) vulnerabilities 8 known vulnerabilities (2 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 21.0.4 (Oct 20, 2026): no advisory affects it - Newest unaffected release: 21.0.4 (Oct 20, 2026), the latest release - Weekly downloads: 32.2M - Dependents: 131 - Releases: 500+ since 7.5.12 (Oct 14, 2022) - Registry: https://www.npmjs.com/package/happy-dom - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118661: 7.5.12 to 20.14.5 (20.14.6 is outside it) - CVE-2026-118660: 7.5.12 to 20.14.6 (21.0.0 is outside it) - CVE-2026-115895: 17.0.0 to 21.0.3 (21.0.4 is outside it) - CVE-2026-34226: 7.5.12 to 20.8.8 (20.8.9 is outside it) - CVE-2026-33943: 15.10.0 to 20.8.7 (20.8.8 is outside it) - CVE-2025-62410: 19.0.0 to 20.0.1 (20.0.2 is outside it) - CVE-2025-61927: 7.5.12 to 19.0.2 (20.0.0 is outside it) - CVE-2024-51757: 7.5.12 to 15.10.1 (15.10.2 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (8) ### [CVE-2026-118661](https://cve.now/CVE-2026-118661): Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies - Severity: Medium 6.5 - Published: Oct 28, 2026 - Affected: fixed in 20.14.6. - Fixed in 20.14.6 (released Oct 8, 2026, 20 days before disclosure). - The latest release, 21.0.4, is not affected. - 54% of happy-dom downloads last week were affected versions (18.6M). ### [CVE-2026-118660](https://cve.now/CVE-2026-118660): Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML - Severity: High 8.6 - Published: Oct 28, 2026 - Affected: fixed in 21.0.0. - Fixed in 21.0.0 (released Oct 11, 2026, 17 days before disclosure). - The latest release, 21.0.4, is not affected. - 62% of happy-dom downloads last week were affected versions (21.1M). ### [CVE-2026-115895](https://cve.now/CVE-2026-115895): Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution - Severity: High 8.8 - Published: Oct 23, 2026 - Affected: from 17.0.0, fixed in 21.0.4. - Fixed in 21.0.4 (released Oct 20, 2026, 3 days before disclosure). - The latest release, 21.0.4, is not affected. - 58% of happy-dom downloads last week were affected versions (19.9M). ### [CVE-2026-34226](https://cve.now/CVE-2026-34226): Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: fixed in 20.8.9. - Fixed in 20.8.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 21.0.4, is not affected. - 15% of happy-dom downloads last week were affected versions (5.1M). ### [CVE-2026-33943](https://cve.now/CVE-2026-33943): Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code - Severity: High 8.8 - Published: Mar 27, 2026 - Affected: from 15.10.0, fixed in 20.8.8. - Fixed in 20.8.8 (released Mar 24, 2026, 3 days before disclosure). - The latest release, 21.0.4, is not affected. - 13% of happy-dom downloads last week were affected versions (4.5M). ### [CVE-2025-62410](https://cve.now/CVE-2025-62410): --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom - Severity: Critical 9.4 - Published: Oct 15, 2025 - Affected: from 19.0.0, fixed in 20.0.2. - Fixed in 20.0.2 (released Oct 15, 2025, the day of disclosure). - The latest release, 21.0.4, is not affected. - 0.2% of happy-dom downloads last week were affected versions (80.4K). ### [CVE-2025-61927](https://cve.now/CVE-2025-61927): Happy-DOM has VM Context Escape - Severity: High 7.2 - Published: Oct 10, 2025 - Affected: fixed in 20.0.0. - Fixed in 20.0.0 (released Oct 9, 2025, 1 day before disclosure). - The latest release, 21.0.4, is not affected. - 9.2% of happy-dom downloads last week were affected versions (3.1M). ### [CVE-2024-51757](https://cve.now/CVE-2024-51757): Fixes security vulnerability that allowed for server side code to be executed by a \ tag - Severity: Critical 9.3 - Published: Nov 6, 2024 - Affected: fixed in 15.10.2. - Fixed in 15.10.2 (released Nov 6, 2024, the day of disclosure). - The latest release, 21.0.4, is not affected. - 1.6% of happy-dom downloads last week were affected versions (534.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/happy-dom Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.