Code Injection in Happy DOM - CVE-2026-115895
Published: November 12, 2026
Vulnerability identifier: #VU165954
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115895
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code with the privileges of the Happy DOM host process.
The vulnerability exists due to improper control of code generation in the Happy DOM ESM compiler when unvalidated import aliases are interpolated into JavaScript with JavaScript evaluation enabled. A remote attacker can induce a victim to process module source containing a malicious import alias and with { type: 'json' } to execute a destructuring default initializer that accesses Node.js host APIs, enabling file access, environment disclosure, and operating-system command execution.
Affected software
Happy DOM
How to mitigate CVE-2026-115895
Install security update from vendor's website.
Happy DOM - update to 21.0.4