capricorn86 happy-dom

• CVE-2026-118661 Medium 6.5 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies 0.3%
• CVE-2026-118660 High 8.6 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML 0.4%
• CVE-2026-118659 High 7.5 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy 0.4%
• CVE-2026-115895 High 8.8 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution 0.5%
• CVE-2026-34226 High 7.5 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies 0.5%
• CVE-2026-33943 High 8.8 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code 0.6%
• CVE-2025-62410 Critical 9.4 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom 0.4%
• CVE-2025-61927 High 7.2 Happy-DOM has VM Context Escape 0.6%
• CVE-2024-51757 Critical 9.3 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag 0.8%