警告脆弱性アドバイザリJavaScript / Node.js2026/10/29 06:06

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

影響: npm:happy-dom <= 20.14.5 → 20.14.6

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts. PoC…

GitHub Advisory Databaseで読む

X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。

フォロー @vulnpulse_app

CVE	CVE-2026-118661
情報源	GitHub Advisory Database
取得日時	2026/10/29 09:48
データ	Markdown　JSON

2026/10/29 06:06、GitHub Advisory Databaseが「Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-118661。