happy-dom
- 21.0.3 is the latest, published 15 October 2026.
- 5 security advisories, all fixed.
- 21.x: 4 releases since 11 October 2026, 30 in the last 90 days.
Security advisories
Grouped by the version that fixes them, so one upgrade reads as one step.
Fixed in 20.8.9 · 1 advisory
Fixed in 20.8.8 · 1 advisory
Fixed in 20.0.2 · 1 advisory
- CRITICALhappy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScriptGHSA-qpm2-6cq5-7pq5
Fixed in 20.0.0 · 1 advisory
- CRITICALHappy DOM: VM Context Escape can lead to Remote Code ExecutionGHSA-37j7-fg3j-429f
1 older fix
Fixed in 15.10.2 · 1 advisory
- CRITICALhappy-dom allows for server side code to be executed by a <script> tagGHSA-96g7-g7g9-jxw8
Releases in the last 90 days
Feed of releases and advisoriesEvery stable release, newest first. Notes are quoted as the maintainers published them.
21.0.3
15 October 2026Fixes security vulnerability where authorization header was forwarded when redirecting -
:construction_worker_man: Patch fixes
- security
Fixes security vulnerability where authorization header was forwarded when redirecting - By @capricorn86
- security
21.0.2
15 October 2026Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer -
:construction_worker_man: Patch fixes
- security
Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By @capricorn86
- security
21.0.1
12 October 2026Adds alias for enabling CSS and iframe loading to @happy-dom/server-renderer -
:construction_worker_man: Patch fixes
Adds alias for enabling CSS and iframe loading to @happy-dom/server-renderer - By @capricorn86
21.0.0
11 October 2026Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) -
:bomb: Breaking Changes
- breaking
Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @capricorn86
An attacker could embed
<iframe>or<link rel="stylesheet">elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.The settings property
disableCSSFileLoadinghas been deprecatedAdded the new settings properties enableCSSFileLoading and enableIframePageLoading
- breaking
20.14.6
8 October 2026Fixes cookie scope forgery vulnerability -
:construction_worker_man: Patch fixes
- security
Fixes cookie scope forgery vulnerability - By @capricorn86
- security
20.14.5
12 September 2026Preserve character references in comment data - By @hampustagerud in task #2409
:construction_worker_man: Patch fixes
Preserve character references in comment data - By @hampustagerud in task #2409
20.14.4
12 September 2026End comments at the first comment end tag when it overlaps a comment start tag - By @hampustagerud in task #2407
:construction_worker_man: Patch fixes
End comments at the first comment end tag when it overlaps a comment start tag - By @hampustagerud in task #2407
20.14.3
9 September 2026Avoids cloning all properties in CSSPropertyManager.toString - By @erictheswift in task #2363
:construction_worker_man: Patch fixes
Avoids cloning all properties in CSSPropertyManager.toString - By @erictheswift in task #2363
20.14.2
9 September 2026Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @klaesra in task #2344
:construction_worker_man: Patch fixes
Fixes regression where not all CSS variables where resolved in
getComputedStyle()- By @klaesra in task #2344
20.14.1
9 September 2026Invalidate the computed style cache for the whole subtree - By @matmannion and @capricorn86 in task #2366
:construction_worker_man: Patch fixes
Invalidate the computed style cache for the whole subtree - By @matmannion and @capricorn86 in task #2366
Show 20 earlier releases
20.14.0
3 September 2026Improves computed style cache - By @capricorn86 in task #2357
:art: Features
Improves computed style cache - By @capricorn86 in task #2357
20.13.2
2 September 2026Fix problem with getComputedStyle with :host and :host-context selectors - By @capricorn86 in task #2349
:construction_worker_man: Patch fixes
Fix problem with getComputedStyle with :host and :host-context selectors - By @capricorn86 in task #2349
20.13.1
2 September 2026GetComputedStyle should return inherited value when it is set to inherit - By @capricorn86 in task #2347
:construction_worker_man: Patch fixes
GetComputedStyle should return inherited value when it is set to inherit - By @capricorn86 in task #2347
20.13.0
2 September 2026Adds support for :host psuedo query selector - By @capricorn86 in task #2345
:art: Features
Adds support for :host psuedo query selector - By @capricorn86 in task #2345
20.12.2
2 September 2026Custom elements should be upgraded when connected to DOM - By @capricorn86 in task #2342
:construction_worker_man: Patch fixes
Custom elements should be upgraded when connected to DOM - By @capricorn86 in task #2342
20.12.1
1 September 2026Adds support for kebab-case properties on CSSStyleDeclaration - By @capricorn86 in task #2256
:art: Features
Adds support for kebab-case properties on
CSSStyleDeclaration- By @capricorn86 in task #2256Adds support for all Chromium CSS properties to
CSSStyleDeclaration- By @capricorn86 in task #2256Downloads a list from the Chromium project when compiling
:construction_worker_man: Patch fixes
Fixes issue with parsing CSS fallback variables - By @capricorn86 in task #2256
20.12.0
29 August 2026Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect -
:art: Features
Adds support for
Animation,AnimationTimeline,DocumentTimelineandKeyframeEffect- By @capricorn86Adds support for
Element.animate()- By @capricorn86
20.11.15
28 August 2026Fixes issue with upgrading custom element caused by previous release - By @capricorn86 in task #2331
:construction_worker_man: Patch fixes
Fixes issue with upgrading custom element caused by previous release - By @capricorn86 in task #2331
20.11.14
28 August 2026Change prototype of element to the custom element when upgraded to keep the reference - By @capricorn86 in task #2331
:construction_worker_man: Patch fixes
Change prototype of element to the custom element when upgraded to keep the reference - By @capricorn86 in task #2331
The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid
20.11.13
28 August 2026Copy event listeners when upgrading a custom element - By @capricorn86 in task #2329
:construction_worker_man: Patch fixes
Copy event listeners when upgrading a custom element - By @capricorn86 in task #2329
20.11.12
27 August 2026Add check for if the node is still a parent during disconnect - By @capricorn86 in task #2322
:construction_worker_man: Patch fixes
Add check for if the node is still a parent during disconnect - By @capricorn86 in task #2322
20.11.11
27 August 2026Use proxy as parent node in Node.connectedToNode - By @diegohaz in task #2253
:construction_worker_man: Patch fixes
Use proxy as parent node in Node.connectedToNode - By @diegohaz in task #2253
20.11.10
27 August 2026Return default validationMessage for built-in constraint violations - By @mixelburg in task #2187
:construction_worker_man: Patch fixes
Return default validationMessage for built-in constraint violations - By @mixelburg in task #2187
20.11.9
27 August 2026Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @capricorn86 in task #2317
:construction_worker_man: Patch fixes
Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @capricorn86 in task #2317
20.11.8
26 August 2026Values pushed or assigned to the adoptedStyleSheet array should be validated - By @capricorn86 in task #2315
:construction_worker_man: Patch fixes
Values pushed or assigned to the
adoptedStyleSheetarray should be validated - By @capricorn86 in task #2315
20.11.7
26 August 2026The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @capricorn86 in task #2313
:construction_worker_man: Patch fixes
The properties
Document.adoptedStyleSheetsandShadowRoot.adoptedStyleSheetsshould validate it's value - By @capricorn86 in task #2313
20.11.6
19 August 2026Updates docs for the global-registrator package - By @capricorn86 in task #2300
:construction_worker_man: Patch fixes
Updates docs for the global-registrator package - By @capricorn86 in task #2300
20.11.5
19 August 2026Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) -
:construction_worker_man: Patch fixes
Allow explicit element types for querySelector (e.g.
querySelector<HTMLInputElement>(".my-input")) - By @cyphercodes
20.11.4
19 August 2026Fixes the CORS check fetch() to match origins instead of host and protocol - By @rexxars in task #1490
:construction_worker_man: Patch fixes
Fixes the CORS check
fetch()to match origins instead of host and protocol - By @rexxars in task #1490
20.11.3
19 August 2026Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299
:construction_worker_man: Patch fixes
Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299
Copy labels array to prevent mutation of cached querySelectorAll result - By @mixelburg in task #2226
Major versions
- 21.xsince 11 October 2026 · latest 21.0.3 · 4 releases
- 20.xsince 9 October 2025 · latest 20.14.6 · 88 releases
- 19.xsince 28 September 2025 · latest 19.0.2 · 3 releases
- 18.xsince 10 June 2025 · latest 18.0.1 · 2 releases
- 17.xsince 5 February 2025 · latest 17.6.3 · 51 releases
- 16.xsince 27 December 2024 · latest 16.8.1 · 29 releases
- 15.xsince 21 August 2024 · latest 15.11.7 · 42 releases
- 14.xsince 19 March 2024 · latest 14.12.3 · 44 releases
- 13.xsince 10 January 2024 · latest 13.10.1 · 53 releases
- 12.xsince 15 September 2023 · latest 12.10.3 · 28 releases
- 11.xsince 6 September 2023 · latest 11.2.0 · 11 releases
- 10.xsince 5 July 2023 · latest 10.11.2 · 35 releases
- 9.xsince 1 April 2023 · latest 9.20.3 · 60 releases
- 8.xsince 7 December 2022 · latest 8.9.0 · 33 releases
- 7.xsince 5 October 2022 · latest 7.8.1 · 40 releases
- 6.xsince 30 June 2022 · latest 6.0.4 · 5 releases
- 5.xsince 31 May 2022 · latest 5.4.0 · 9 releases
- 4.xsince 19 May 2022 · latest 4.1.0 · 4 releases
- 3.xsince 26 April 2022 · latest 3.2.2 · 6 releases
- 2.xsince 14 December 2020 · latest 2.55.0 · 106 releases
- 1.xsince 4 October 2020 · latest 1.18.2 · 58 releases
- 0.xsince 15 September 2019 · latest 0.14.1 · 68 releases
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
Reading npm and deps.dev…
Registry facts last checked 16 October 2026. Releases and advisories last read 16 October 2026.
Know when your own dependencies move
Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.