Prototype Pollution Vulnerability in Happy-Dom by Capricorn86
CVE-2025-62410

9.4CRITICAL

Key Information:

Vendor

Capricorn86

Status
Happy-dom
Vendor
CVE Published:
15 October 2025

What is CVE-2025-62410?

Prior to version 20.0.2, Happy-Dom contained a vulnerability that allowed untrusted JavaScript to run unchecked alongside secure code. Due to an incomplete isolation mechanism from the --disallow-code-generation-from-strings feature, attackers could exploit this vulnerability to perform prototype pollution attacks. Such attacks could lead to hijacking crucial application references, such as 'process', and manipulating application control flows. This issue arises from a previous vulnerability (CVE-2025-61927) that was not fully addressed, necessitating an update to version 20.0.2 for full protection.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

happy-dom < 20.0.2

References

https://github.com/capricorn86/happy-dom/security/advisor...
x_refsource_CONFIRM
https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.