Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

GHSA-5FPQ-26GF-QWCR Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.5...

CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118661

Happy DOM, a JavaScript-based web browser implementation, is vulnerable to cookie scope forgery in versions prior to 20.14.6 . The root cause is located in src/cookie/CookieContainer.ts, where the cookieMatchesURL function fails to enforce a DNS-label boundary when matching Domain attributes. Thi...

CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789899321)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789899321 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790154364)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790154364 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

CLSA-2026-1790154364 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1790152441 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789900426 Fix CVE(s): CVE-2026-80230, CVE-2026-82209

SECURITY UPDATE: public key pinning bypassed when no server certificate - debian/patches/CVE-2026-80230.patch: in lib/vtls/openssl.c, treat a missing server certificate as acceptable only when no pinned public key is configured, so pinning is still enforced with peer and host verification disable...

CLSA-2026-1789900215 Fix CVE(s): CVE-2026-18924, CVE-2026-80230, CVE-2026-82209

SECURITY UPDATE: HTTP/2 server push use-after-free - debian/patches/CVE-2026-18924.patch: make a pushed transfer inherit the parent handle's share in lib/http2.c, so a connection held by a share cannot be freed while the pushed transfer still uses it. - CVE-2026-18924 SECURITY UPDATE: public key...

CLSA-2026-1789899988 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899690 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899321 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CVE-2026-82209

A flaw was found in libcurl when libpsl support is enabled. A remote attacker could exploit this vulnerability by setting a Set-Cookie header with a Domain attribute that explicitly matches a public suffix. This improper handling causes libcurl to save the cookie with a wildcard domain scope,...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

AZL-99882 CVE-2026-82209 affecting package tensorflow 2.16.1-11

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

CVE-2026-82209: Insertion of Sensitive Information Into Sent Data

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...