Happy-dom (Capricorn86) - vulnerabilities (CVEs)
9 CVEs, 4 in the last 30 days, 2 known versions, newest CVE from 2026-10-28. Vendor: Capricorn86.
CVEs of Happy-dom
- CVE-2026-118661 - CVSS 6.5 (medium), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in…
- CVE-2026-118660 - CVSS 8.6 (high), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link…
- CVE-2026-118659 - CVSS 7.5 (high), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's…
- CVE-2026-115895 - CVSS 8.8 (high), 2026-10-23: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4,…
- CVE-2026-34226 - CVSS 7.5 (high), 2026-03-27: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current…
- CVE-2026-33943 - CVSS 9.8 (critical), 2026-03-27: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection…
- CVE-2025-62410 - CVSS 9.4 (critical), 2025-10-15: In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The…
- CVE-2025-61927 - CVSS 7.2 (high), 2025-10-10: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that…
- CVE-2024-51757 - CVSS 9.3 (critical), 2024-11-06: happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the…
