GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...