PT-2026-28614 · Happy-Dom · Happy-Dom

R74Tech · Published 2026-03-27 · Updated 2026-03-29 · CVE-2026-34226

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Happy DOM versions prior to 20.8.9

Description Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, has an issue where it may attach cookies from the current page origin instead of the request target URL when using fetch(..., { credentials: "include" }). This can lead to the leakage of cookies from one origin to another. The issue is related to cookie selection in getRequestHeaders() within the file packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts, where the originURL used for cookie lookup represents the page URL instead of the request destination URL. A proof-of-concept script demonstrates how this can be exploited by setting cookies on different origins and then triggering a cross-host request with credentials included. This can result in sensitive information disclosure, specifically cookie leakage, impacting applications that rely on happy-dom in authenticated or session-based flows.

Recommendations Update to Happy DOM version 20.8.9 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

CWE-359

Related Identifiers

CVE-2026-34226

GHSA-W4GP-FJGQ-3Q4G

Affected Products

Happy-Dom

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34226.json · Exploit
• https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g · Vendor Advisory
• https://github.com/capricorn86/happy-dom/pull/2117 · Patch
• https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751 · Patch
• https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts · Patch
• https://osv.dev/vulnerability/GHSA-w4gp-fjgq-3q4g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34226 · Security Note
• https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9 · Note
• https://github.com/capricorn86/happy-dom · Note
• https://twitter.com/VulmonFeeds/status/2037711337405485442 · Twitter Post
• https://twitter.com/CVEnew/status/2037719366972932504 · Twitter Post