# CVE-2026-34226: capricorn86 Happy DOM cookie leakage in fetch requests

Source: https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-34226 · Severity: high · CVSS 7.5 · Published 2026-03-27

Happy DOM, a tool used to simulate web browser environments for testing and automation, contains a flaw that can leak sensitive login information. When making web requests, the software may incorrectly send cookies belonging to the current page to a completely different destination. This could allow an attacker to intercept session tokens or private user data if they can influence where the software sends its requests.

Technologies: [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34226 being exploited in the wild.

**How severe is CVE-2026-34226?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** happy-dom (npm) SEMVER:introduced=0,fixed=20.8.9.

**Is there a fix for CVE-2026-34226?** Yes. happy-dom (npm): upgrade to 20.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34226 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34226?** Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 20.8.9 or later

  ```sh
  npm install happy-dom@20.8.9
  ```


## Technical details

A vulnerability exists in Happy DOM's fetch implementation where the 'credentials: include' option causes the library to attach cookies from the current window.location (Origin A) to a request targeting a different destination (Origin B). The root cause is located in the FetchRequestHeaderUtility and CookieContainer components, which failed to properly validate that cookies matched the target request URL before inclusion. An attacker who can control the destination of a fetch request initiated within a Happy DOM environment can capture cookies belonging to the environment's current origin. This issue is fixed in version 20.8.9 by ensuring cookie matching logic strictly adheres to the target URL.

## Affected products

- capricorn86 happy-dom < 20.8.9
- Red Hat Red Hat Ansible Automation Platform 2 2

## Identifiers

- CVE-2026-34226
- GHSA-w4gp-fjgq-3q4g

## Timeline

- 2026-03-26: patched: Version 20.8.9 released to address the cookie leakage.
- 2026-03-27: disclosed: Security advisory published.

## References

- [https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts](https://github.com/capricorn86/happy-dom/blob/f8d8cad41e9722fab9eefb9dfb3cca696462e908/packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts)
- [https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751](https://github.com/capricorn86/happy-dom/commit/68324c21d7b98f53f7bb5a7b3e185bda7106e751)
- [https://github.com/capricorn86/happy-dom/pull/2117](https://github.com/capricorn86/happy-dom/pull/2117)
- [https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9](https://github.com/capricorn86/happy-dom/releases/tag/v20.8.9)
- [https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-w4gp-fjgq-3q4g)
- [https://access.redhat.com/security/cve/CVE-2026-34226](https://access.redhat.com/security/cve/CVE-2026-34226)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452519](https://bugzilla.redhat.com/show_bug.cgi?id=2452519)

## Related threats

- [Happy DOM cookie scope forgery in CookieContainer](https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM server-side request forgery via iframe and CSS loading](https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler](https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler)
- [happy-dom prototype pollution allowing arbitrary code execution](https://junglewise.ai/threats/cve-2025-62410-happy-dom-prototype-pollution-allowing-arbitrary-code-execution)