Is CVE-2026-118661 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118661 being exploited in the wild.

How severe is CVE-2026-118661?

Medium severity, with a CVSS score of 6.5, published 28 October 2026.

Which products and versions are affected?

Capricorn86 Happy DOM before 20.14.6; happy-dom (npm) <= 20.14.5, SEMVER:introduced=0,fixed=20.14.6.

Is there a fix for CVE-2026-118661?

Yes. happy-dom (npm): upgrade to 20.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118661 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118661?

Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118661: Happy DOM cookie scope forgery in CookieContainer

Q: Is there a fix for CVE-2026-118661?

Yes. happy-dom (npm): upgrade to 20.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118661 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118661?

Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118661 · Severity: medium · CVSS 6.5 · Published 2026-10-28

Happy DOM is a headless browser implementation used in server-side rendering and prerendering applications. The CookieContainer fails to properly validate cookie Domain attributes, allowing an attacker to forge cookies for unrelated domains. In applications that contact attacker-controlled servers before making requests to victim services, this enables session fixation or cookie injection attacks.

Technologies: Capricorn86 Happy DOM, happy-dom (npm). Vendors: Capricorn86, npm.

Quick answers

Is CVE-2026-118661 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118661 being exploited in the wild.
How severe is CVE-2026-118661?: Medium severity, with a CVSS score of 6.5, published 28 October 2026.
Which products and versions are affected?: Capricorn86 Happy DOM before 20.14.6; happy-dom (npm) <= 20.14.5, SEMVER:introduced=0,fixed=20.14.6.
Is there a fix for CVE-2026-118661?: Yes. happy-dom (npm): upgrade to 20.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118661 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118661?: Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

happy-dom (npm): upgrade to 20.14.6 or later
```
npm install happy-dom@20.14.6
```

Technical details

The CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes: it accepts domains unrelated to the origin setting the cookie (including public suffixes), and the cookieMatchesURL function fails to enforce DNS-label boundaries when matching suffixes. An attacker can plant forged cookies in a server-side rendering context and have them delivered to a victim origin, exploiting inadequate cookie scope validation.

Affected products

capricorn86 Happy DOM before 20.14.6

Identifiers

CVE-2026-118661
GHSA-5fpq-26gf-qwcr

Timeline

2026-10-28: disclosed
2026-10-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.