npm/happy-dom CVE-2025-62410: critical 9.4, EPSS 0.36%
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
Action: Upgrade happy-dom to 20.0.2 or later.
npm i happy-dom@20.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 19.0.0 | 20.0.2 | - |
Fixed versions
| 20.0.2 |
Sources
- osv: GHSA-qpm2-6cq5-7pq5
- nvd: CVE-2025-62410
- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5
- https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea
- https://github.com/capricorn86/happy-dom
CVE-2025-62410 · published · modified · JSON