CVE-2026-115895: high-severity vulnerability in capricorn86 happy-dom
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
capricorn86 · happy-domRelated CVEs — capricorn86 happy-dom
In the same product, most dangerous first.
CVE-2024-51757CRITICALFixes security vulnerability that allowed for server side code to be executed by a <script> tagEPSS 0.8%CVE-2026-33943HIGHHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeEPSS 0.6%CVE-2025-61927HIGHHappy-DOM has VM Context EscapeEPSS 0.6%CVE-2026-34226HIGHHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesEPSS 0.5%CVE-2026-118660HIGHHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLEPSS 0.4%CVE-2026-118659HIGH@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open ProxyEPSS 0.4%