Packages / happy-dom / Security

CriticalVulnerabilityGHSA-96g7-g7g9-jxw8CVE-2024-51757Published 6 Nov 2024

happy-dom allows for server side code to be executed by a <script> tag

Affected releases · happy-dom

  • 15.x15.0.0 – 15.10.1Fixed in 15.10.2
  • 14.x and older0.0.1 – 14.12.3No fix, no longer updated

On 15.x, the newest line:

npm install happy-dom@15.10.2
21.x

  1. Not affected

    21.0.0 – 21.0.4

    5 releases, latest

15.x

  1. Affected

    15.0.0 – 15.10.1

    27 releases

  2. Fixed

    15.10.2 – 15.11.7

    15 releases

14.x

  1. Affected

    14.0.0 – 14.12.3

    44 releases

13.x

  1. Affected

    13.0.0 – 13.10.1

    53 releases

12.x

  1. Affected

    12.0.0 – 12.10.3

    28 releases

11.x

  1. Affected

    11.0.0 – 11.2.0

    11 releases

10.x

  1. Affected

    10.0.0 – 10.11.2

    35 releases

9.x

  1. Affected

    9.0.0 – 9.20.3

    60 releases

8.x

  1. Affected

    8.0.0 – 8.9.0

    33 releases

7.x

  1. Affected

    7.0.0 – 7.8.1

    40 releases

6.x

  1. Affected

    6.0.0 – 6.0.4

    5 releases

5.x

  1. Affected

    5.0.0 – 5.4.0

    9 releases

4.x

  1. Affected

    4.0.0 – 4.1.0

    4 releases

3.x

  1. Affected

    3.0.0 – 3.2.2

    6 releases

2.x

  1. Affected

    2.0.0 – 2.55.0

    106 releases

1.x

  1. Affected

    1.0.0 – 1.18.2

    58 releases

0.x

  1. Affected

    0.0.1 – 0.14.1

    68 releases

780 stable releases of happy-dom, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for happy-dom. It is read in your browser and sent nowhere.

What happens

Impact

Consumers of the NPM package happy-dom

Patches

The security vulnerability has been patched in v15.10.2

Workarounds

No easy workarounds to my knowledge

References

#1585