npm

happy-dom

6 Total advisories

6 Vulnerabilities

0 Malware

Dependency scanning

Check whether happy-dom is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 8.8

npm

CVE-2026-115895

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Oct 23, 2026

HIGH 8.8

npm

CVE-2026-33943

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Mar 26, 2026

HIGH 7.5

npm

CVE-2026-34226

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Mar 29, 2026

UNKNOWN

npm

CVE-2025-62410

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Oct 15, 2025

UNKNOWN

npm

CVE-2025-61927

Happy DOM: VM Context Escape can lead to Remote Code Execution

Oct 10, 2025

UNKNOWN

npm

CVE-2024-51757

happy-dom allows for server side code to be executed by a <script> tag

Nov 6, 2024

Browse more npm advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes