07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +19 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =0.31.0-next.1.g20b3b5c16, =0.1.0, =0.1.1, =0.2.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =0.1.0-alpha.0, =9.0.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-34226 Source advisory: OSV:GHSA-W4GP-FJGQ-3Q4G...

CVE-2026-33943

A flaw was found in Happy DOM, a JavaScript implementation of a web browser. This vulnerability allows a remote attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions. The ECMAScriptModuleCompiler component fails to properly sanitize content within export...

07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +19 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)

happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =0.31.0-next.1.g20b3b5c16, =0.1.0, =0.1.1, =0.2.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =0.1.0-alpha.0, =9.0.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-34226 Source advisory: SNYK:JS-HAPPYDOM-15810980...

Insertion of Sensitive Information Into Sent Data

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the fetch...

Insertion of Sensitive Information Into Sent Data

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data vi...

CVE-2026-34226

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...

CVE-2026-33943

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions insi...

07-calito-router (>=0.0.2, <=0.0.4), @acdh-oeaw/universalviewer (4.1.0) +570 more potentially affected by CVE-2026-34226 via happy-dom (>=0.0.1, <=20.8.8)

happy-dom NPM version =0.0.1, =0.0.2, =0.1.0, =0.4.1, =0.1.0, =0.1.0, =0.6.1, =0.0.0, =0.1.1, =0.1.0, =0.9.0, =16.0.0, =0.1.0-dev.000c377e11b18c5110d5255f08eff9f74b0c67e8, =0.5.0, =0.5.1 and more Source cves: CVE-2026-34226 Source advisory: MEND:CVE-2026-34226...

CVE-2026-34226

Technical details about CVE-2026-34226 are not publicly provided in the supplied documents. Monitor for updates on affected versions, root cause, and remediation.

CVE-2026-34226

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...

CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...

CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...

CVE-2026-34226 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin window.location instead of the request target URL when fetch..., credentials: "include" is used. This can leak cookies from orig...

07-calito-router (>=0.0.2, <=0.0.4), @adbl/cartridge (>=0.0.0, <=0.0.8) +254 more potentially affected by CVE-2026-33943 via happy-dom (>=15.10.2, <=20.8.7)

happy-dom NPM version =15.10.2, =0.0.2, =0.0.0, =0.1.1, =0.1.0, =18.0.11, =0.5.0, =0.4.2, =0.1.10, =0.3.0, =0.1.0-alpha.1, =0.1.0 - @chialab/sveltekit-utils 0.1.0-alpha.8 - @choiceform/design-js-tokens 0.1.0 - @codai/testing-utils 1.0.0 and more Source cves: CVE-2026-33943 Source advisory:...

CVE-2026-33943

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions insi...

CVE-2026-33943 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions insi...

CVE-2026-33943

Happy DOM CVE-2026-33943 involves a code-injection vulnerability in the ECMAScriptModuleCompiler: in versions 15.10.0 through 20.8.7, unsanitized content within export { ... } in ES modules is interpolated into generated code as an executable expression, with backticks not removed, enabling templ...

CVE-2026-33943 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions insi...

CVE-2026-33943 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions insi...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2026-34073 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...