Vulnerabilities

Vulnerability · CVE-2026-115895

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Published Oct 23, 2026 · catalog updated Oct 23, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115895. EPSS is 0.47%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

High8.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.47%

Remediation

Version ranges on file

Affected products

npm happy-dom · vendor capricorn86 happy-dom

## Summary The ESM compiler in does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates in the local handler, but the named import handler still places an unvalidated directly into code context. These issues were confirmed through the public and APIs using the published npm package. The PoC reaches the Node.js host , obtains , and creates a proof directory on the host filesystem. ## Confirmed affected versions The PoC was directly tested against: - - - - The same PoC does not trigger on . The ESM compiler was introduced by commit , first released in . The vulnerable interpolation remains present through , the latest release at the time of testing. Suggested affected range: No patched version is currently available. ## Preconditions - JavaScript evaluation is enabled with . - Attacker-controlled HTML or module source is processed by Happy DOM. - This may affect SSR, preview, scraping, or testing services that evaluate externally supplied HTML. ## Technical details In , the named import handler splits an import specifier and extracts its alias: Unlike the patched handler, the value of is not validated as a JavaScript identifier. It is subsequently inserted directly into generated binding syntax: Consider the following source: This is invalid ECMAScript module syntax. Node.js rejects it at the token. Happy DOM instead transforms it into the equivalent of: This generated JavaScript is valid. Because the imported JSON object does not contain a property, the default initializer executes. The attribute is relevant because the compiler only generates its circular import resolver for ESM imports: Using a JSON module prevents the malicious alias from being emitte