Description
happy-dom may attach cookies from the current page origin (window.location) instead of the request target URL when fetch(..., { credentials: "include" }) is used. This can leak cookies from origin A to destination B.
Recommendation
Update the happy-dom package to the latest compatible version. Followings are version details:
- Affected version(s): < 20.8.9
- Patched version(s): 20.8.9
References
Could your website be exposed too?
SmartScanner can check your website for Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code - CVE-2026-33943
- happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript - CVE-2025-62410
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - @nuxt/webpack-builder - CVE-2026-49993
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
You might also like:
See something that needs correcting? Let us knowUpdated March 29, 2026