Happy DOM: unsanitized ESM import alias enables host code execution (CVE-2026-115895)
Severity: high · Patch status: patched · Since 2026-10-20 · CVE-2026-115895, CVE-2026-33943
Happy DOM's ESM compiler fails to validate import binding aliases before interpolating them into generated JavaScript, an incomplete fix for CVE-2026-33943. An invalid import alias is transformed into a valid destructuring default initializer that executes, letting attacker-controlled HTML or module source escape the sandbox and reach Node.js host APIs (e.g., node:fs) to execute arbitrary code. Confirmed affected in v17.0.0 through v21.0.3; v16.8.1 is not affected. Exploitation requires enableJavaScriptEvaluation: true and attacker-controlled HTML/module input, affecting SSR, preview, scraping, and testing services. Fixed in happy-dom 21.0.4. A public PoC exists; no in-the-wild exploitation known.
What to do
- Upgrade happy-dom to 21.0.4 or later immediately
- If upgrade is not possible, disable enableJavaScriptEvaluation or ensure it never processes attacker-controlled HTML/module source
- Audit SSR, preview, scraping, and testing services that evaluate untrusted HTML with happy-dom for exposure
- Check hosts for artifacts such as a HAPPY_DOM_RCE_PROOF directory or unexpected process/node:fs access
- Review dependent repositories and CI pipelines that render untrusted content via happy-dom
Fixed versions
Sources
All live incidents on Threat Watch
