Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118661 · GHSA-5fpq-26gf-qwcr

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Risk score
49/100
CVSS
6.5 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a pu…
Affected
happy-dom (npm) <= 20.14.5
Fix
Upgrade happy-dom to 20.14.6 or later.
Exploitation
Public proof of concept

Story map

Story map: happy-domTHE FLAWSTHE FIXCVE-2026-118661Happy DOM has cookie scopeforgery: no DNS-label boundaryon Domain= matching …CVSS 6.5CVE-2026-115895Happy DOM: Incomplete fix forCVE-2026-33943: unsanitizedimport alias leads to host…CVSS 8.8 · EPSS 0%CVE-2026-118660Happy DOM: SSRF via iframeand link stylesheet whenparsing untrusted HTMLCVSS 8.6Upgrade happy-dom20.14.6 · 21.0.4 · 21.0.0or later on your release lineWho is exposed{'products': ['Happy DOM'],'packages': ['happy-dom'],'versions': ['>= 17.0.0, <=21.0.3']}AMBER · PATCH THIS WEEKhappy-domA vulnerability in Happy DOMallows an attacker to executehost code by inserting anunsanitized import alias into agenerated destructuring binding.This could lead to code executionin the Node.js host process.Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-565 (CWE-565)2 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

happy-dom: Amber, patch this week. A vulnerability in Happy DOM allows an attacker to execute host code by inserting an unsanitized import alias into a generated destructuring binding. This could lead to code execution in the Node.js host process.

The flaws

  • CVE-2026-118661: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVSS 6.5)
  • CVE-2026-115895: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-118660: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML (CVSS 8.6)

The fix

Upgrade happy-dom: 20.14.6 · 21.0.4 · 21.0.0 or later on your release line

Who is exposed: {'products': ['Happy DOM'], 'packages': ['happy-dom'], 'versions': ['>= 17.0.0, <= 21.0.3']}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
happy-domnpm<= 20.14.520.14.6

References

Original description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.

Last activity 28 Oct 2026. Patch Forecast updates every hour.