CVE-2026-118661

The record

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.

Affected packages

Related vulnerabilities

• CVE-2026-119128 ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login… CWE-565
• CVE-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that… CWE-565
• CVE-2026-111749 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-565
• CVE-2026-75757 Reliance on Cookies without Validation and Integrity Checking vulnerability in… CWE-565
• CVE-2026-53871 Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the… CWE-565
• CVE-2026-8337 Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site… CWE-565
• CVE-2026-0257 Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo… CWE-565
• CVE-2026-39963 Serendipity is a PHP-powered weblog engine. CWE-565