07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +19 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =0.31.0-next.1.g20b3b5c16, =0.1.0, =0.1.1, =0.2.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =0.1.0-alpha.0, =9.0.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-34226 Source advisory: OSV:GHSA-W4GP-FJGQ-3Q4G...

07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +19 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =0.31.0-next.1.g20b3b5c16, =0.1.0, =0.1.1, =0.2.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =0.1.0-alpha.0, =9.0.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-34226 Source advisory: SNYK:JS-HAPPYDOM-15810980...

CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...