CVE-2026-118661: Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering and prerendering applications that contact attacker-controlled origins and then make requests to a victim origin, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation. This issue is fixed in version 20.14.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Happy DOMto a version that resolves this vulnerability.Fixed in 20.14.6
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Server-side rendering and prerendering applications using Happy DOM are exposed when they contact attacker-controlled origins and subsequently make requests to a victim origin. The issue can allow the attacker-controlled origin to plant a cookie that Happy DOM later delivers to the victim origin.
What does an attacker need to exploit this?
The attacker needs their origin to be contacted by the affected application before the application requests the victim origin. No privileges or user interaction are required according to the provided vector.
Are versions with the fix affected?
No. The issue is fixed in Happy DOM version 20.14.6; versions prior to 20.14.6 are affected.