# CVE-2024-51757: happy-dom server-side code execution via script tag

Source: https://junglewise.ai/threats/cve-2024-51757-happy-dom-server-side-code-execution-via-script-tag  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-51757 · Severity: medium · CVSS 4 · Published 2024-11-06

happy-dom is a JavaScript library that simulates a DOM environment for server-side rendering and testing. The vulnerability allows attackers to execute arbitrary code on the server by injecting a script tag, potentially leading to data theft, server compromise, or application takeover depending on the server's permissions and the data it can access.

Technologies: [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-51757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-51757 being exploited in the wild.

**How severe is CVE-2024-51757?** Medium severity, with a CVSS score of 4, published 6 November 2024.

**Which products and versions are affected?** happy-dom (npm) SEMVER:introduced=0,fixed=15.10.2.

**Is there a fix for CVE-2024-51757?** Yes. happy-dom (npm): upgrade to 15.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-51757 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-51757?** Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 15.10.2 or later

  ```sh
  npm install happy-dom@15.10.2
  ```


## Technical details

The vulnerability is a code execution flaw (CWE-79 / XSS-variant) in happy-dom's script tag handling. The root cause is insufficient sanitization or execution context isolation when processing <script> tags in parsed HTML content. An attacker can craft malicious HTML containing a script tag that, when parsed by happy-dom on the server, executes arbitrary JavaScript in the server's Node.js runtime. The attack requires the application to parse untrusted HTML input using happy-dom but does not require authentication or user interaction. The vulnerability has been patched in version 15.10.2.

## Affected products

- happy-dom happy-dom before 15.10.2

## Identifiers

- CVE-2024-51757
- GHSA-96g7-g7g9-jxw8

## Timeline

- 2024-11-06: disclosed
- 2024-11-06: patched: Version 15.10.2 released

## References

- [https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8)

## Related threats

- [Happy DOM cookie scope forgery in CookieContainer](https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM server-side request forgery via iframe and CSS loading](https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM cookie leakage in fetch requests](https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests)
- [capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler](https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler)