{"id":"EUVD-2026-16893","revision":"8971fc8a7c174a7399b837a439017ce0","records":[{"revision":"8971fc8a7c174a7399b837a439017ce0","observedAt":"2026-11-01T06:05:58.114+00:00","statement":{"source":"euvd","id":"EUVD-2026-16893","aliases":["CVE-2026-34226","GHSA-w4gp-fjgq-3q4g"],"title":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., …","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: \"include\" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g","https://github.com/capricorn86/happy-dom/pull/2117","https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751","https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts","https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16893","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 27, 2026, 9:17:24 PM","dateUpdated":"Jul 15, 2026, 1:04:37 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-16893","identifiers":["EUVD-2026-16893","CVE-2026-34226","GHSA-w4gp-fjgq-3q4g"]},"retained":false,"historicalAffected":[]}],"coverage":[]}