happy-dom
21.0.4 · 20 Oct 2026MIT13.1M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for happy-dom. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 21.0.4 | No known advisory | |
| 20.14.6 | Safe from 20.8.9 | |
| 19.0.2 | 103 open advisories, worst critical · last release Sep 2025, no longer updated |
- Criticalhappy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScriptGHSA-qpm2-6cq5-7pq5 · 15 Oct 2025
- 20.x20.0.0 – 20.0.1Fixed in 20.0.2
- 19.x19.0.0 – 19.0.2No fix on 19.x · move to 20.0.2
- CriticalHappy DOM: VM Context Escape can lead to Remote Code ExecutionGHSA-37j7-fg3j-429f · 10 Oct 2025
- 19.x and older0.0.1 – 19.0.2No fix, no longer updated
- Criticalhappy-dom allows for server side code to be executed by a <script> tagGHSA-96g7-g7g9-jxw8 · 6 Nov 2024
- 15.x15.0.0 – 15.10.1Fixed in 15.10.2
- 14.x and older0.0.1 – 14.12.3No fix, no longer updated · move to 15.10.2
- HighHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesGHSA-w4gp-fjgq-3q4g · 29 Mar 2026
- 20.x20.0.0 – 20.8.8Fixed in 20.8.9
- 19.x and older0.0.1 – 19.0.2No fix, no longer updated · move to 20.8.9
- HighHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeGHSA-6q6h-j7hj-3r64 · 26 Mar 2026
- 20.x20.0.0 – 20.8.7Fixed in 20.8.8
- 19.x and older15.10.0 – 19.0.2No fix, no longer updated · move to 20.8.8
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.