Cookie Injection Vulnerability in Happy DOM JavaScript Implementation
CVE-2026-118661

6.5MEDIUM

Key Information:

Vendor: Capricorn86
Status: Happy-dom
Vendor: CVE Published:; 28 October 2026

🔔 Create Capricorn86 Vulnerability Alert

What is CVE-2026-118661?

In Happy DOM, prior to version 20.14.6, the CookieContainer component fails to verify Domain cookie attributes accurately. This oversight allows the acceptance of cookies from unrelated domains, including public suffixes, leading to cookie injection or session fixation. Malicious actors can exploit this flaw in server-side rendering and prerendering applications to compromise user sessions by leveraging requests to victim origins. The vulnerability has been addressed in version 20.14.6.