CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118661?
CVE-2026-118661 is a medium-severity vulnerability in capricorn86 happy-dom, published on 28 Oct 2026.
Official description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.
Weakness: CWE-565
Which versions are affected by CVE-2026-118661?
2 open source packages ship an affected version, including happy-dom.
| Package | Affected | Fixed in |
|---|---|---|
happy-dom npm | All versions | 20.14.6 |
happy-dom npm | All versions | 20.14.6 |
How do I fix CVE-2026-118661?
Upgrade happy-dom to 20.14.6 or later.
Is CVE-2026-118661 being exploited?
There is no known exploitation of CVE-2026-118661 in the wild and no public exploit code.
Sources
Also known as GHSA-5fpq-26gf-qwcr.