CVE-2026-118661

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118661

Happy DOM, a JavaScript-based web browser implementation, is vulnerable to cookie scope forgery in versions prior to 20.14.6 . The root cause is located in src/cookie/CookieContainer.ts, where the cookieMatchesURL function fails to enforce a DNS-label boundary when matching Domain attributes. Thi...

EUVD-2026-112468

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...