Prototype Pollution Vulnerability in Happy-Dom by Capricorn86

CVE-2025-62410

What is CVE-2025-62410?

Prior to version 20.0.2, Happy-Dom contained a vulnerability that allowed untrusted JavaScript to run unchecked alongside secure code. Due to an incomplete isolation mechanism from the --disallow-code-generation-from-strings feature, attackers could exploit this vulnerability to perform prototype pollution attacks. Such attacks could lead to hijacking crucial application references, such as 'process', and manipulating application control flows. This issue arises from a previous vulnerability (CVE-2025-61927) that was not fully addressed, necessitating an update to version 20.0.2 for full protection.

References