Product by Capricorn86

    Happy-dom

    9 known vulnerabilities in Happy-dom (Capricorn86), 0 of them actively exploited (CISA KEV).

    Key figures

    9

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Happy-dom (Capricorn86)
    HighCVE-2026-115895

    Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

    		8.8
    CriticalCVE-2026-33943

    Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

    		9.8
    HighCVE-2026-118660

    Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

    		8.6
    CriticalCVE-2024-51757

    Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

    		—
    HighCVE-2026-118659

    @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

    		7.5
    HighCVE-2025-61927

    Happy-DOM has VM Context Escape

    		—
    HighCVE-2026-34226

    Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

    		7.5
    MediumCVE-2026-118661

    Capricorn86 Happy-dom: Reliance on Cookies without Validation and Integrity Checking

    		6.5
    CriticalCVE-2025-62410

    Capricorn86 Happy-dom: Prototype Pollution

    		—

    All products by Capricorn86