07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +13 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =9.0.0, =0.0.6, =5.50.0, =5.49.5, =0.5.0-rc.2, =0.1.10, =1.1.83, =1.1.92 Source cves: CVE-2026-34226 Source advisory: OSV:GHSA-W4GP-FJGQ-3Q4G...

07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +13 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =9.0.0, =0.0.6, =5.50.0, =5.49.5, =0.5.0-rc.2, =0.1.10, =1.1.83, =1.1.92 Source cves: CVE-2026-34226 Source advisory: SNYK:JS-HAPPYDOM-15810980...

CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...