{"id":"ghsa-ghsa-5fpq-26gf-qwcr","seq":2056961,"kind":"advisory","title":"Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies","url":"https://github.com/advisories/GHSA-5fpq-26gf-qwcr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5fpq-26gf-qwcr","summary":"影響: npm:happy-dom <= 20.14.5 → 20.14.6\nA cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts. PoC…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-118661"],"tags":["GHSA-5fpq-26gf-qwcr","happy-dom"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:06:13.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}