Is CVE-2025-61927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61927 being exploited in the wild.

How severe is CVE-2025-61927?

Medium severity, with a CVSS score of 4, published 10 October 2025.

Which products and versions are affected?

happy-dom (npm) SEMVER:introduced=0,fixed=20.0.0.

Is there a fix for CVE-2025-61927?

Yes. happy-dom (npm): upgrade to 20.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-61927?

Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61927: Happy DOM VM Context Escape leading to Remote Code Execution

CVE-2025-61927 · Severity: medium · CVSS 4 · Published 2025-10-10

Happy DOM is a JavaScript library that simulates a DOM environment for server-side rendering and testing. Versions 19 and below allow attackers to escape the VM sandbox by exploiting how JavaScript functions inherit from a global Function constructor, potentially gaining access to process-level functionality like file system and module loading. An attacker who can execute untrusted JavaScript code within Happy DOM can read environment variables, access configuration files, execute arbitrary commands, and modify the host system.

Technologies: happy-dom (npm). Vendors: npm.

Quick answers

Is CVE-2025-61927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61927 being exploited in the wild.
How severe is CVE-2025-61927?: Medium severity, with a CVSS score of 4, published 10 October 2025.
Which products and versions are affected?: happy-dom (npm) SEMVER:introduced=0,fixed=20.0.0.
Is there a fix for CVE-2025-61927?: Yes. happy-dom (npm): upgrade to 20.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-61927?: Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

happy-dom (npm): upgrade to 20.0.0 or later
```
npm install happy-dom@20.0.0
```

Technical details

The vulnerability is a code injection issue (CWE-94) caused by improper VM isolation in Node.js. Happy DOM wraps JavaScript execution in a VM Context; however, the JavaScript standard's prototype chain allows objects to reference the global Function constructor via constructor.constructor. An attacker can invoke this Function constructor with arbitrary code strings to execute code at the process level (outside the VM). JavaScript evaluation is enabled by default in versions 19 and below. With CommonJS, this grants access to the require() function to load arbitrary modules; with ESM, attackers gain direct process object access. The attack requires only the ability to inject or control HTML/JavaScript content passed to Happy DOM. Patched in version 20.0.0, which disables JavaScript evaluation by default and warns if it is enabled without the Node.js flag --disallow-code-generation-from-strings.

Affected products

Capricorn86 Happy DOM 0 to 19

Identifiers

CVE-2025-61927
GHSA-37j7-fg3j-429f

Timeline

2025-10-10: disclosed: Advisory published
2025-10-10: patched: Happy DOM v20.0.0 released with JavaScript evaluation disabled by default

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.