CVE-2026-115895

Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3

Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When enableJavaScriptEvaluation is enabled, an attacker can provide specially crafted HTML or module source containing an invalid alias. This alias can be transformed into a valid JavaScript default initializer during compilation, allowing the execution of arbitrary JavaScript within the Node.js host process. This issue can be exploited to access the Node.js process object and built-in modules, such as node:fs, enabling unauthorized filesystem operations or command execution. The exploitation path often utilizes a JSON module import attribute to ensure the generated function remains syntactically valid by preventing the malicious alias from being emitted in circular-import assignments.

Recommendations Update happy-dom to version 21.0.4. As a temporary mitigation, disable the enableJavaScriptEvaluation setting if it is not strictly required for the application's functionality.