← Vulnerability feed

Vulnerability record · CVE-2026-34226 · published 27 March 2026

CVE-2026-34226: Capricorn86 happy dom vulnerability

CCapricorn86 · Happy Dom

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.

7.5 CVSS 3.1 High EPSS 0.59% · top 54.0% CWE-201 · CWE-201CWE-359 · CWE-359
7.5CVSS 3.1 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 1 tagged exploit
19 Aug 2026Last modified by NVD

Description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/util Patch
https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751 Patch
https://github.com/capricorn86/happy-dom/pull/2117 Issue TrackingPatch
https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9 ProductRelease Notes
https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g ExploitVendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34226
https://bugzilla.redhat.com/show_bug.cgi?id=2452519
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34226.json

Track CVE-2026-34226 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-33943Capricorn86 happy dom code injection vulnerabilityHappy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection …EPSS 0.97%

Source: NIST National Vulnerability Database (record CVE-2026-34226), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.