GHSA-6q6h-j7hj-3r64
High · 8.8CVSS
8.8
EPSS
—
Published
Mar 26, 2026
CISA due date
—
The record
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | happy-dom | 15.10.0 | 20.8.8 |
Related vulnerabilities
- CVE-2026-33943 Happy DOM is a JavaScript implementation of a web browser without its graphical user… Same vulnerability
- GHSA-w4gp-fjgq-3q4g Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin… Also affects happy-dom
- CVE-2026-34226 Happy DOM is a JavaScript implementation of a web browser without its graphical user… Also affects happy-dom
- CVE-2025-61927 Happy DOM is a JavaScript implementation of a web browser without its graphical user… Also affects happy-dom
- CVE-2024-51757 happy-dom is a JavaScript implementation of a web browser without its graphical user… Also affects happy-dom
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94