## Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-115895
- 公開日時: 2026-10-23T22:06:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-834v-8h66-3h79)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-834v-8h66-3h79

影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4
The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…