MediumAdvisoryJavaScript / Node.js10/29/2026, 06:06 AM

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

影響: npm:happy-dom <= 20.14.5 → 20.14.6

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts. PoC…

Read on GitHub Advisory Database

Get these alerts on XExploits, big breaches and outages, with what to do.

Follow @vulnpulse_app

CVE	CVE-2026-118661
Source	GitHub Advisory Database
Fetched	10/29/2026, 09:48 AM
Data	Markdown　JSON

On 10/29/2026, 06:06 AM, GitHub Advisory Database published "Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-118661.