happy-dom has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 8.6 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
3
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-115895High· 8.8Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution48CVE-2026-118660High· 8.6Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML47CVE-2026-118661Medium· 6.5Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies36
happy-dom vulnerabilities
CVEs affecting happy-dom, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-118661Medium· 6.5Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
▾ Sunlithappy-dom · happy-domvia GHSA
CVE-2026-118660High· 8.6Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
▾ Twilighthappy-dom · happy-domvia GHSA
CVE-2026-115895High· 8.8Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
▾ Twilighthappy-dom · happy-domEPSS 0.37%via GHSA