## Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-118661
- 公開日時: 2026-10-28T21:06:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5fpq-26gf-qwcr)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5fpq-26gf-qwcr

影響: npm:happy-dom <= 20.14.5 → 20.14.6
A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts. PoC…