CVE-2025-62410
1 advisory.
npm/happy-dom CVE-2025-62410: critical, EPSS 0.35%
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
Action: Upgrade happy-dom to 20.0.2 or later.
npm i happy-dom@20.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 19.0.0 | 20.0.2 | - |
Fixed versions
| 20.0.2 |
Sources
- osv: GHSA-qpm2-6cq5-7pq5
- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5
- https://nvd.nist.gov/vuln/detail/CVE-2025-62410
- https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea
- https://github.com/capricorn86/happy-dom
CVE-2025-62410 · published · modified · JSON