CVE-2025-62410

CVE-2025-62410 affects happy-dom prior to version 20.0.2, where the --disallow-code-generation-from-strings mitigation does not fully isolate untrusted JavaScript. The untrusted script and the rest of the application run in the same Isolate/process, allowing prototype-pollution payloads to hijack...