{"id":"EUVD-2026-112468","enisaUuid":"8191cab8-b3e3-3a73-bf1d-7773bd8f8d73","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM\u0027s CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.","datePublished":"Oct 28, 2026, 8:30:23 PM","dateUpdated":"Oct 28, 2026, 8:30:23 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-5fpq-26gf-qwcr\nhttps://github.com/capricorn86/happy-dom/pull/2477\nhttps://github.com/capricorn86/happy-dom/commit/f21dbd7d0a0c63cdd41954ba5d0f05def4e0f2b3\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.14.6\n","aliases":"CVE-2026-118661\nGHSA-5fpq-26gf-qwcr\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"1e3e1f1d-aa21-3b10-84bb-c3b9e3394818","product":{"name":"happy-dom","vendor":{"name":"capricorn86"}},"product_version":"\u003c 20.14.6"}],"enisaIdVendor":[{"id":"aeffe7db-db87-37cb-8734-3b9078691990","vendor":{"name":"capricorn86"}}],"enisaIdVulnerability":[{"id":"8ffeb111-5568-352a-8b9d-f45bf2406ec0","vulnerability":{"id":"GHSA-5fpq-26gf-qwcr","description":"Happy DOM has cookie scope forgery: no DNS-label boundary on Domain\u003d matching , attacker origin sets victim cookies","datePublished":"Oct 28, 2026, 9:06:13 PM","dateUpdated":"Oct 28, 2026, 9:06:13 PM","baseScore":0.0,"references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-5fpq-26gf-qwcr\nhttps://github.com/capricorn86/happy-dom/pull/2477\nhttps://github.com/capricorn86/happy-dom/commit/f21dbd7d0a0c63cdd41954ba5d0f05def4e0f2b3\nhttps://github.com/capricorn86/happy-dom\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.14.6\n","enisa_id":"EUVD-2026-112468\n","aliases":"CVE-2026-118661\nGHSA-5fpq-26gf-qwcr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 7:04:12 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d0c93621-a2b5-3c66-bf6e-6188bf8527a6","vulnerability":{"id":"CVE-2026-118661","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM\u0027s CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.","datePublished":"Oct 28, 2026, 8:30:23 PM","dateUpdated":"Oct 28, 2026, 8:30:23 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-5fpq-26gf-qwcr\nhttps://github.com/capricorn86/happy-dom/pull/2477\nhttps://github.com/capricorn86/happy-dom/commit/f21dbd7d0a0c63cdd41954ba5d0f05def4e0f2b3\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.14.6\n","enisa_id":"EUVD-2026-112468\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 1, 2026, 7:16:36 AM","vulnerabilityProduct":[{"id":"60e7eb71-c5dc-3f0c-b455-2a14c149fe44","product":{"name":"happy-dom","vendor":{"name":"capricorn86"}},"product_version":"\u003c 20.14.6"}],"vulnerabilityVendor":[{"id":"db63d807-7aa8-3012-bc13-0cd8f26ea7f4","vendor":{"name":"capricorn86"}}]}}],"enisaIdAdvisory":[]}