CVE-2026-34226
1 advisory.
npm/happy-dom CVE-2026-34226: high 7.5
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
Action: Upgrade happy-dom to 20.8.9 or later.
npm i happy-dom@20.8.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 20.8.9 | - |
Fixed versions
| 20.8.9 |
Sources
- osv: GHSA-w4gp-fjgq-3q4g
- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g
- https://nvd.nist.gov/vuln/detail/CVE-2026-34226
- https://github.com/capricorn86/happy-dom/pull/2117
- https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751
- https://github.com/capricorn86/happy-dom
- https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts
- https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9
CVE-2026-34226 · published · modified · JSON