Skip to content

chore(deps): update dependency happy-dom to v20 [security] #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency happy-dom to v20 [security] #100

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
happy-dom ^6.0.4 -> ^20.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2024-51757

Impact

Consumers of the NPM package happy-dom

Patches

The security vulnerability has been patched in v15.10.2

Workarounds

No easy workarounds to my knowledge

References

#​1585

CVE-2025-61927

Escape of VM Context gives access to process level functionality

Summary

Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

What the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Reproduce

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
     const require = process.mainModule.require;
  
     console.log('Files:', require('fs').readdirSync('.').slice(0,3));
  </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
  
     console.log('PID:', process.pid);
  </script>
`);

Potential Impact

Server-Side Rendering (SSR)

const { Window } = require('happy-dom');
const window = new Window();
window.document.innerHTML = userControlledHTML;

Testing Frameworks

Any test suite using Happy-DOM with untrusted content may be at risk.

Attack Scenarios

  1. Data Exfiltration: Access to environment variables, configuration files, secrets
  2. Lateral Movement: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.).
  3. Code Execution: Child process access for running arbitrary commands
  4. Persistence: File system access

Recommended Immediate Actions

  1. Update Happy DOM to v20 or above
    • This version has JavaScript evaluation disabled by default
    • This version will output a warning if JavaScript is enabled in an insecure environment
  2. Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled
    • This makes sure that evaluation can't be used at process level to escape the VM
    • eval() and Function() can still be used within the Happy DOM VM without any known security risk
    • Happy DOM v20 and above will output a warning if this flag is not in use
  3. If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment

Technical Root Cause

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

Running Node with the "--disallow-code-generation-from-strings" flag protects against this.

Release Notes

capricorn86/happy-dom (happy-dom)

v20.0.0

Compare Source

v19.0.2

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue related to CSS pseudo selector :scope that didn't work correctly for direct descendants to root - By @​capricorn86 in task #​1620

v19.0.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue with sending in URLs as string in @happy-dom/server-renderer config using CLI - By @​capricorn86 in task #​1908

v19.0.0

Compare Source

💣 Breaking Changes
  • Removes support for CommonJS - By @​capricorn86 in task #​1730
    • Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using require()
  • Updates Jest to v30 in the @happy-dom/jest-environment package - By @​capricorn86 in task #​1730
  • Makes Jest packages peer dependencies to make it easier to align versions with the project using @happy-dom/jest-environment - By @​capricorn86 in task #​1730
🎨 Features
  • Adds a new package called @happy-dom/server-renderer - By @​capricorn86 in task #​1730
    • This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application
    • Read more in the Wiki under Server-Renderer
  • Adds support for import.meta to the ESM compiler - By @​capricorn86 in task #​1730
  • Adds support for the CSS pseudo selector :scope - By @​capricorn86 in task #​1620
  • Improves support for MediaList - By @​capricorn86 in task #​1730
  • Adds support for CSSKeywordValue, CSSStyleValue, StylePropertyMap, StylePropertyMap, StylePropertyMapReadOnly - By @​capricorn86 in task #​1730
  • Improves debug information in the ESM compiler - By @​capricorn86 in task #​1730
  • Adds validation of browser settings when creating a new Browser instance - By @​capricorn86 in task #​1730
  • Adds support for the browser setting navigation.beforeContentCallback which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By @​capricorn86 in task #​1730
  • Adds support for the browser setting fetch.requestHeaders which provides with a declarative and simple way to add request headers - By @​capricorn86 in task #​1730
  • Adds support for setting an object to timer.preventTimerLoops which makes it possible to define different settings for setTimeout() and requestAnimationFrame() - By @​capricorn86 in task #​1730
  • Adds support for the browser setting viewport which makes it possible to define a default viewport size - By @​capricorn86 in task #​1730
  • Adds support for the parameters beforeContentCallback and headers to BrowserFrame.goto(), BrowserFrame.goBack(), BrowserFrame.goForward(), BrowserFrame.goSteps() and BrowserFrame.reload() - By @​capricorn86 in task #​1730
  • Adds support for PopStateEvent and trigger the event when navigating the page history using History.pushState() - By @​capricorn86 in task #​1730
  • Use local file paths for virtual server files in stack traces - By @​capricorn86 in task #​1730
  • Adds support for ResponseCache.fileSystem.load() and ResponseCache.fileSystem.save() for storing and loading cache from the file system - By @​capricorn86 in task #​1730
👷‍♂️ Patch fixes
  • Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By @​capricorn86 in task #​1730
  • Disables the same origin policy when navigating a browser frame using BrowserFrame.goto() - By @​capricorn86 in task #​1730
  • Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By @​capricorn86 in task #​1730
  • Adds try and catch to listeners for events dispatched from XMLHttpRequest to prevent it from being set to an invalid state if a listener throws an Error - By @​capricorn86 in task #​1730

v18.0.1

Compare Source

👷‍♂️ Patch fixes
  • Addresses an issue where an error occurred if the Element ID was set to the same name as a Window property with a null value - By @​capricorn86 in task #​1841

v18.0.0

Compare Source

💣 Breaking Changes
  • Makes the types for Happy DOM strict - By @​capricorn86 in task #​1154
    • This makes it possible to use the option skipLibCheck set to "false" in the typescript configuration for projects with a strict configuration
    • This change has resulted in that some types has changed and is therefore considered as a breaking change
  • BrowserContext.close() now throws an error when trying to close the default context of a browser - By @​capricorn86 in task #​1154
🎨 Features

v17.6.3

Compare Source

👷‍♂️ Patch fixes

v17.6.2

Compare Source

👷‍♂️ Patch fixes

v17.6.1

Compare Source

🎨 Features
  • Adds support for disabling validation of certificates, to allow for self-signed certificates to be used - By @​capricorn86 in task #​1763
    • Read more about the new setting fetch.disableStrictSSL under IBrowserSettings in the Wiki

v17.6.0

Compare Source

v17.5.9

Compare Source

👷‍♂️ Patch fixes
  • Adds missing null check in HTMLLinkElement for a browser frame property that becomes null during teardown of a Window - By @​capricorn86 in task #​1800

v17.5.8

Compare Source

👷‍♂️ Patch fixes
  • Incorrect cache matching caused Element.classList to return the wrong items - By @​capricorn86 in task #​1812

v17.5.7

Compare Source

👷‍♂️ Patch fixes
  • Handle wider range of valid characters in unquoted attribute value parsing - By @​AudunWA in task #​1817

v17.5.6

Compare Source

👷‍♂️ Patch fixes
  • Removes the min and max boundary check when setting the value of an input field of type "date" - By @​zgrybus in task #​1815

v17.5.5

Compare Source

v17.5.4

Compare Source

👷‍♂️ Patch fixes

v17.5.3

Compare Source

👷‍♂️ Patch fixes
  • Adds previousSibling and nextSibling to MutationObserver records when a child is removed - By @​uxuip in task #​1803

v17.5.2

Compare Source

👷‍♂️ Patch fixes
  • Adds support for the unicode characters « and » in query selectors used by the React 19.1 "useId" hook - By @​terrymun in task #​1785

v17.5.1

Compare Source

👷‍♂️ Patch fixes
  • Existing URL query string should be overwritten on form submit when method is "GET" - By @​rslabbert in task #​1786

v17.5.0

Compare Source

🎨 Features

v17.4.9

Compare Source

👷‍♂️ Patch fixes

v17.4.8

Compare Source

👷‍♂️ Patch fixes

v17.4.7

Compare Source

👷‍♂️ Patch fixes

v17.4.6

Compare Source

👷‍♂️ Patch fixes

v17.4.5

Compare Source

👷‍♂️ Patch fixes

v17.4.4

Compare Source

👷‍♂️ Patch fixes
  • Sets 0 instead of undefined as default in setTimeout() to prevent Bun from logging a "TimeoutNaNWarning" - By @​lekoala in task #​1772

v17.4.3

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where the wrong scope was used when settings.errorCapture is not set to "tryAndCatch" and handleEvent is used for the event listener - By @​capricorn86 in task #​1766

v17.4.2

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where an error was thrown for "xmlns" or unknown prefixes in Element.setAttribute() - By @​capricorn86 in task #​1750

v17.4.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where an error was thrown for attributes "xlink" or an unknown prefix during parsing of HTML - By @​capricorn86 in task #​1750

v17.4.0

Compare Source

🎨 Features

v17.3.2

Compare Source

👷‍♂️ Patch fixes

v17.3.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where an error was thrown for attributes with "xmlns" as prefix during parsing of HTML (e.g. <svg xmlns:link=""></svg>) - By @​capricorn86 in task #​1750

v17.3.0

Compare Source

🎨 Features

v17.2.4

Compare Source

👷‍♂️ Patch fixes

v17.2.3

Compare Source

👷‍♂️ Patch fixes
  • Element.contentEditable should be synced with the "contenteditable" attribute - By @​karpiuMG in task #​1463

v17.2.2

Compare Source

👷‍♂️ Patch fixes

v17.2.1

Compare Source

👷‍♂️ Patch fixes
  • Handle nested square brackets and parentheses inside pseudo-class arguments - By @​karpiuMG in task #​1072

v17.2.0

Compare Source

🎨 Features

v17.1.13

Compare Source

👷‍♂️ Patch fixes

v17.1.12

Compare Source

👷‍♂️ Patch fixes

v17.1.11

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue with attribute references when using Element.cloneNode() - By @​Mas0nShi in task #​1745

v17.1.10

Compare Source

👷‍♂️ Patch fixes

v17.1.9

Compare Source

👷‍♂️ Patch fixes
  • Event listener properties prefixed with "on" should be the evaluated value of the corresponding attribute - By @​capricorn86 in task #​474

v17.1.8

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where change event wasn't triggered for an input inside of a label - By @​capricorn86 in task #​1614

v17.1.7

Compare Source

👷‍♂️ Patch fixes

v17.1.6

Compare Source

🎨 Features
  • Adds support for sending AbortSignal as option to EventTarget.addEventListener() - By @​karpiuMG in task #​1540

v17.1.5

Compare Source

👷‍♂️ Patch fixes
  • HTMLElement.dataset should return undefined for properties not found - By @​karpiuMG in task #​1689

v17.1.4

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where the use of filtering in TreeWalker didn't work according to spec - By @​capricorn86 in task #​1605

v17.1.3

Compare Source

👷‍♂️ Patch fixes
  • Fixes incorrect handling of attribute prefixes when iterating NamedNodeMap - By @​capricorn86 in task #​1728
    • This caused attribute names to be incorrectly returned in Element.getAttributeNames() when attributes where using prefixes

v17.1.2

Compare Source

👷‍♂️ Patch fixes
  • AbortSignal.reason can have any type - By @​btea in task #​1718
  • When aborting a request, AbortSignal.reason should be the object used when the promise is rejected - By @​btea in task #​1718

v17.1.1

Compare Source

🎨 Features
👷‍♂️ Patch fixes
  • Fixes issue where it was not possible to nest @media, @supports and @container rules - By @​capricorn86 in task #​1727
  • Fixes issue where CSSStyleSheet was instantiated internally without a Window context, causing errors to not be thrown correctly in CSSStyleSheet methods - By @​capricorn86 in task #​1727
  • Changes errors thrown in CSSStyleSheet methods, so that they work according to spec - By @​capricorn86 in task #​1727

v17.1.0

Compare Source

🎨 Features
  • Add support for CSS media query rule "prefers-reduced-motion" - By @​mwdiaz in task #​1724

v17.0.4

Compare Source

👷‍♂️ Patch fixes
  • The "slotchange" event should be fired after the element has been connected to the DOM - By @​capricorn86 in task #​1722

v17.0.3

Compare Source

👷‍♂️ Patch fixes
  • Fixes bug where nested query selectors is not returning the correct result when there are multiple matching selector groups - By **@​christiango ** in task #​1720

v17.0.2

Compare Source

👷‍♂️ Patch fixes
  • The property "tabIndex" should return "0" by default in HTMLAnchorElement, HTMLAreaElement, HTMLButtonElement, HTMLIFrameElement, HTMLInputElement, HTMLMediaElement, HTMLObjectElement, HTMLSelectElement and HTMLTextAreaElement - By @​capricorn86 in task #​1714

v17.0.1

Compare Source

👷‍♂️ Patch fixes
  • Ensure querySelector() returns the first item that appears in the DOM for grouped selectors - By @​christiango in task #​1710

v17.0.0

Compare Source

💣 Breaking Changes
  • Adds support for ECMAScript modules - By @​capricorn86 in task #​320
    • This change allows the use of import and export statements in JavaScript files
🎨 Features
  • Adds support for tracing never ending tasks when using waitUntilComplete() - By @​capricorn86 in task #​1567
    • Read more about how to enable this feature under debug.traceWaitUntilComplete in the Wiki for IBrowserSettings
  • Adds support for preloading fetch, stylesheet, script and modules in HTMLLinkElement - By @​capricorn86 in task #​320
  • Adds support for HTMLLinkElement.relList.supports() - By @​capricorn86 in task #​320
  • Adds support for Request.mode - By @​capricorn86 in task #​320
  • Output failed requests to the console - By @​capricorn86 in task #​320
  • Adds support for HTMLScriptElement.blocking, HTMLScriptElement.crossOrigin, HTMLScriptElement.fetchPriority, HTMLScriptElement.noModule, HTMLScriptElement.integrity, HTMLScriptElement.referrerPolicy - By @​capricorn86 in task #​320
  • Use cache in virtual server requests - By @​capricorn86 in task #​320
  • Adds support for credentials and referrerPolicy when fetching styles and scripts - By @​capricorn86 in task #​320
  • Disallow invalid attributes from being set in Element.setAttribute() - By @​OlaviSau in task #​1706
👷‍♂️ Patch fixes
  • Call afterAsyncResponse fetch interceptor in virtual server requests - By @​capricorn86 in task #​320
  • Fixes bug where children in a ShadowRoot of a custom element that was upgraded from a HTMLElement wasn't considered connected to the DOM - By @​capricorn86 in task #​320

v16.8.1

Compare Source

👷‍♂️ Patch fixes

v16.8.0

Compare Source

🎨 Features

v16.7.3

Compare Source

👷‍♂️ Patch fixes
  • Removes space from directory name that prevents the repo to be cloned on MS Windows - By @​kleinfreund in task #​1703

v16.7.2

Compare Source

👷‍♂️ Patch fixes

v16.7.1

Compare Source

👷‍♂️ Patch fixes
  • Adds ICookie, IOptionalCookie, CookieSameSiteEnum and IVirtualServer as exports to the index file - By @​capricorn86 in task #​1693
  • Makes non-mandatory cookie properties optional in CookieContainer.addCookies() - By @​capricorn86 in task #​1693

v16.7.0

Compare Source

🎨 Features
  • Adds support for simulating local HTTP servers that serves files from the local file system - By @​capricorn86 in task #​1688
    • Read more about virtual servers in the Wiki

v16.6.0

Compare Source

🎨 Features
  • Adds support for subsequent sibling combinator to querySelector(), querySelectorAll() and matches() (e.g. ".a ~ .b") - By @​karpiuMG in task #​1683

v16.5.3

Compare Source

👷‍♂️ Patch fixes
  • Fixes problem with encoding and decoding attribute values in HTML - By @​capricorn86 in task #​1678
  • Fixes issue where it was not possible to query selector by class when the attribute value had line breaks in it - By @​capricorn86 in task #​1678

v16.5.2

Compare Source

👷‍♂️ Patch fixes
  • Event.target should be the target element after an event has been dispatched - By @​capricorn86 in task #​1529

v16.5.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where Comment, Text and DocumentFragment are not instances of their corresponding property on Window - By @​capricorn86 in task #​1577

v16.5.0

Compare Source

🎨 Features

v16.4.3

Compare Source

👷‍♂️ Patch fixes
  • Adds null check for if browser frame is available in Response during tear down of the Window - By @​capricorn86 in task #​1669

v16.4.2

Compare Source

👷‍♂️ Patch fixes

v16.4.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where HTML assigned to document.documentElement.innerHTML isnt parsed correctly since v16 - By @​capricorn86 in task #​1663

v16.4.0

Compare Source

🎨 Features

v16.3.0

Compare Source

🎨 Features
  • Adds support for child combinator to ":has()" pseudo selector (e.g. "span:has(> video)") - By @​capricorn86 in task #​1642

v16.2.9

Compare Source

👷‍♂️ Patch fixes
  • Fixes the HTMLInputElement.defaultChecked property - By @​capricorn86 in task #​1587
    • This issue caused React not to serialize the "checked" attribute correctly

v16.2.8

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where the wrong event target was used when dispatching events on HTMLFormElement or HTMLSelectElement - By @​capricorn86 in task #​1628

v16.2.7

Compare Source

👷‍♂️ Patch fixes
  • Fixes issue where text in <script> and <style> elements should not be decoded or encoded - By @​capricorn86 in task #​1564

v16.2.6

Compare Source

👷‍♂️ Patch fixes
  • Fixes problem where snapshots did not result in HTML for <form> and <select> elements - By @​capricorn86 in task #​1608

v16.2.5

Compare Source

👷‍♂️ Patch fixes
  • Fixes bug where the reference to a parent HTMLFormElement and HTMLSelectElement was wrong which affected the methods remove(), replaceWith(), before(), after(), append(), prepend(), replaceChildren() and insertAdjacentElement() - By @​capricorn86 in task #​1637

v16.2.4

Compare Source

👷‍♂️ Patch fixes
  • Fixes bug where the incorrect location is set after a redirect in BrowserFrame.goto() and DetachedBrowserFrame.goto() - By @​capricorn86 in task #​1627

v16.2.3

Compare Source

👷‍♂️ Patch fixes

v16.2.2

Compare Source

👷‍♂️ Patch fixes
  • Improves error when a Symbol object is being sent to querySelector() or querySelectorAll() as selector - By @​chocolateboy in task #​1640

v16.2.1

Compare Source

👷‍♂️ Patch fixes
  • Set request credentials to "same-origin" in XMLHttpRequest when "withCredentials" is false - By @​saitonakamura in task #​1631

v16.2.0

Compare Source

🎨 Features

v16.1.0

Compare Source

🎨 Features

v16.0.1

Compare Source

👷‍♂️ Patch fixes
  • Fixes problem with children of created documents (e.g. document.implementation.createHTMLDocument()) not being considered as connected to a DOM that was introduced in v16 - By @​capricorn86 in task #​1647

v16.0.0

[Compare Source](https://redirect.github.com/capricorn86/happy-dom/com

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title chore(deps): update dependency happy-dom to v15 [security] chore(deps): update dependency happy-dom to v15 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-happy-dom-vulnerability branch December 8, 2024 19:01
@renovate renovate bot changed the title chore(deps): update dependency happy-dom to v15 [security] - autoclosed chore(deps): update dependency happy-dom to v15 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
@renovate renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 5943ad2 to 89b0f49 Compare December 8, 2024 22:01
@renovate renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 89b0f49 to e6d4c27 Compare August 10, 2025 14:27
@renovate renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from e6d4c27 to f6403bc Compare September 25, 2025 16:26
@renovate renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from f6403bc to e497493 Compare October 11, 2025 01:47
@renovate renovate bot changed the title chore(deps): update dependency happy-dom to v15 [security] chore(deps): update dependency happy-dom to v20 [security] Oct 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Type: Dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants