JavaScript Binding Validation Flaw in Happy DOM by Capricorn86
CVE-2026-115895

8.8HIGH

Key Information:

Vendor

Capricorn86

Status
Happy-dom
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115895?

Happy DOM, a JavaScript emulator, contains a vulnerability where named ESM import aliases are not properly validated before use in destructuring bindings. This flaw allows an attacker to exploit the system by embedding malicious HTML or module sources that can manipulate imported aliases, leading to unauthorized JavaScript execution within the Node.js host process. This issue stems from an incomplete fix to a previous vulnerability and affects versions 17.0.0 through 21.0.3. It has been addressed in version 21.0.4, which provides enhanced validation to prevent such malicious activities.

Affected Version(s)

happy-dom >= 17.0.0, < 21.0.4

References

https://github.com/capricorn86/happy-dom/security/advisor...
x_refsource_CONFIRM
https://github.com/capricorn86/happy-dom/pull/2537
x_refsource_MISC
https://github.com/capricorn86/happy-dom/commit/fd163520b...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.