Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

GHSA-5FPQ-26GF-QWCR Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.5...

CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118661

Happy DOM, a JavaScript-based web browser implementation, is vulnerable to cookie scope forgery in versions prior to 20.14.6 . The root cause is located in src/cookie/CookieContainer.ts, where the cookieMatchesURL function fails to enforce a DNS-label boundary when matching Domain attributes. Thi...