CVE-2026-118661

Name of the Vulnerable Software and Affected Versions happy-dom versions prior to 20.14.6

Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. The CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. Specifically, the cookieMatchesURL() function fails to enforce a DNS-label boundary, allowing it to treat an unrelated suffix-sharing hostname as a match. Additionally, it may accept a Domain unrelated to the origin setting the cookie, including a public suffix. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can allow an attacker to plant and deliver a forged cookie, leading to cookie injection or session fixation.

Recommendations Update happy-dom to version 20.14.6 or later.