Zero Radar
← feed
HighVulnerabilityCVE-2026-115895updated 25 Oct 2026, 13:32 UTC

happy-dom lets attacker HTML run code on the Node.js server

If your server runs happy-dom on HTML from outside sources, a crafted page can make the server run hidden code. The attacker could then read or change files on your machine.

Fixed in 21.0.4Official, 2 sources
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes21.0.4 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts HTMLPage contains a module with an invalid import alias
  2. 2happy-dom processes pageJavaScript evaluation is enabled
  3. 3Alias compiled uncheckedInvalid alias becomes a valid default initializer
  4. 4Code runs on Node hostInitializer executes in the host process
  5. ResultAttacker runs code on the server

What happened

The ESM compiler in happy-dom does not validate named import aliases before inserting them into generated JavaScript. An invalid alias can be turned into a valid default initializer that executes in the Node.js host process when enableJavaScriptEvaluation is enabled. This is an incomplete fix for GHSA-6q6h-j7hj-3r64 / CVE-2026-33943.

Why it is dangerous: Successful exploitation runs code on the Node.js host with its privileges, allowing file access and host compromise. Services that render or test untrusted HTML, such as SSR, preview, scraping, or testing services, are at risk.

Are you affected?

You are affected if you use happy-dom 17.0.0 through 21.0.3 with enableJavaScriptEvaluation enabled and process attacker-controlled HTML or module source.

Package / productAffected versionsFixed in
happy-dom · npm>= 17.0.0, <= 21.0.321.0.4

What to do

  1. Update happy-dom to 21.0.4 or later
  2. If you cannot update now, set enableJavaScriptEvaluation to false for any untrusted HTML
  3. Review services that evaluate external HTML or module source and restrict their privileges

Timeline

  1. 23 Oct 2026, 22:06 UTC
    Publicly disclosed
  2. 23 Oct 2026, 22:06 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 23 Oct 2026, 22:16 UTC
    Reported by NVD · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115895 · GHSA-834v-8h66-3h79
CVSS
8.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 22:06 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

happy-dom lets attacker HTML run code on the Node.js server · Zero Radar