보통취약점 권고JavaScript / Node.js2026. 10. 29. 오전 06:06

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

影響: npm:happy-dom <= 20.14.5 → 20.14.6

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts. PoC…

GitHub Advisory Database에서 읽기

X에서 속보 받기악용·대형 유출·장애를 대응 방법과 함께.

팔로우 @vulnpulse_app

CVE	CVE-2026-118661
정보원	GitHub Advisory Database
수집 시각	2026. 10. 29. 오전 09:48
데이터	Markdown　JSON

2026. 10. 29. 오전 06:06, GitHub Advisory Database에서 "Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118661.