CVE-2026-115895 in Happy DOM
Summary
by MITRE • 10/24/2026
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
Happy DOM serves as a headless JavaScript implementation of a web browser, designed to execute client-side code within Node.js environments without rendering graphical interfaces. Between versions 17.0.0 and 21.0.4, the library contained a critical security flaw in its ECMAScript module compiler located at packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts. This vulnerability stems from an insufficient validation mechanism when processing named ES Module imports. Specifically, the compiler accepted user-supplied import aliases without verifying that they constituted valid JavaScript binding identifiers before inserting them into generated destructuring bindings. This lack of sanitization allowed attacker-controlled input to bypass standard syntax checks during the compilation phase.
The operational impact of this flaw is severe due to its interaction with the enableJavaScriptEvaluation configuration flag. When this feature is active, the library executes compiled code within the host Node.js process context rather than in an isolated sandbox. An attacker can exploit this by providing malicious HTML or module source that includes an invalid alias which, after compilation and transformation into a default initializer, becomes syntactically valid JavaScript. This allows arbitrary code execution on the server side. The attack vector specifically leverages JSON module import attributes to mask the malicious payload. By using these attributes, the attacker prevents the malformed alias from being re-emitted during subsequent ES Module circular-import assignments, thereby ensuring that the generated function remains syntactically correct and executable without triggering immediate parser errors.
This vulnerability represents a distinct residual path resulting from an incomplete remediation of CVE-2026-33943. The previous security fix addressed validation for local export import names but failed to extend these checks to named-import aliases. This oversight created a gap that allowed the specific attack pattern described above to succeed where other paths were secured. The issue highlights the complexity of securing dynamic code generation systems, particularly when handling multiple entry points for module resolution and binding creation.
To mitigate this risk, organizations must upgrade Happy DOM to version 21.0.4 or later, which includes comprehensive validation for all import alias types. Additionally, developers should critically evaluate the necessity of enabling JavaScript evaluation in production environments where untrusted input is processed. Adhering to strict content security policies and validating all module sources against a whitelist of allowed identifiers can further reduce exposure. This incident aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the injection of malicious code through improper validation of user-supplied data during compilation. It also relates to ATT&CK technique T1059 Command and Scripting Interpreter, specifically JavaScript execution within a server-side context facilitated by vulnerable libraries.