CVE-2026-115895: Happy DOM code injection in ESM compiler

CVE-2026-115895 · Severity: high · CVSS 8.8 · Published 2026-10-23

Happy DOM is a JavaScript library that simulates a browser DOM environment in Node.js, often used for server-side rendering and testing. An incomplete fix for a prior vulnerability leaves a path for attackers to inject and execute arbitrary code by crafting malicious import statements in module source code. An attacker can exploit this to read files, execute commands, or access sensitive environment data on the host system.

Technologies: Capricorn86 Happy DOM, happy-dom (npm). Vendors: Capricorn86, npm.

Quick answers

Is CVE-2026-115895 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115895 being exploited in the wild.
How severe is CVE-2026-115895?
High severity, with a CVSS score of 8.8, published 23 October 2026.
Which products and versions are affected?
Capricorn86 Happy DOM 17.0.0 to 21.0.3; Happy-Dom Contributors Happy-Dom 17.0.0 through 20.14.5; happy-dom (npm) >= 17.0.0, <= 21.0.3, SEMVER:introduced=17.0.0,fixed=21.0.4.
Is there a fix for CVE-2026-115895?
Yes. happy-dom (npm): upgrade to 21.0.4 or later. Until then: Disable JavaScript evaluation by setting enableJavaScriptEvaluation to false in Happy DOM settings, or do not process untrusted module source code through Happy DOM.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Vulnerability advisory GHSA-834v-8h66-3h79 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115895 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115895?
Check whether you run Capricorn86 Happy DOM, Happy-Dom Contributors Happy-Dom or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • happy-dom (npm): upgrade to 21.0.4 or later
    npm install happy-dom@21.0.4

Disable JavaScript evaluation by setting enableJavaScriptEvaluation to false in Happy DOM settings, or do not process untrusted module source code through Happy DOM.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23","note":"Vulnerability advisory GHSA-834v-8h66-3h79 published"}]

Technical details

The ECMAScript module compiler in Happy DOM fails to validate the local binding alias in named imports before interpolating it into generated JavaScript. Specifically, unvalidated alias values are inserted directly into destructuring binding syntax, allowing an attacker to inject a default initializer expression that executes when the binding resolves to undefined. When combined with JSON module imports (which bypass circular import re-emission), the injected code reaches Node.js host APIs like process and node:fs.

Affected products

  • happy-dom contributors happy-dom 17.0.0 through 20.14.5

Identifiers

  • CVE-2026-115895
  • GHSA-834v-8h66-3h79

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.