CVE-2026-34226highCWE-201CWE-359

CVE-2026-34226: falha de alta gravidade em capricorn86 happy-dom

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar happy-dom+ Monitorar happy-dom

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
capricorn86 · happy-dom
CVEs relacionadas — capricorn86 happy-dom

No mesmo produto, das mais perigosas para as menos.

CVE-2024-51757CRITICALFixes security vulnerability that allowed for server side code to be executed by a <script> tagEPSS 0.8%CVE-2026-33943HIGHHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeEPSS 0.6%CVE-2025-61927HIGHHappy-DOM has VM Context EscapeEPSS 0.6%CVE-2026-115895HIGHHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionEPSS 0.5%CVE-2026-118660HIGHHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLEPSS 0.4%CVE-2026-118659HIGH@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open ProxyEPSS 0.4%