CVE-2025-62410: happy-dom RCE Vulnerability

CVE-2025-62410 Overview

CVE-2025-62410 is a critical prototype pollution vulnerability affecting happy-dom, a JavaScript DOM implementation commonly used for server-side rendering and testing. The vulnerability exists because the --disallow-code-generation-from-strings flag is insufficient for isolating untrusted JavaScript code. Since both the untrusted script and the main application execute within the same Isolate/process, attackers can leverage prototype pollution payloads to hijack critical references such as the process object or manipulate control flow by modifying undefined property checks.

This vulnerability represents an incomplete fix for CVE-2025-61927, indicating that the previous remediation did not fully address the underlying security concern.

Critical Impact

Attackers can execute arbitrary code by exploiting prototype pollution to hijack critical JavaScript references and manipulate application control flow, potentially leading to full system compromise.

Affected Products

• happy-dom versions prior to 20.0.2

Discovery Timeline

• 2025-10-15 - CVE-2025-62410 published to NVD
• 2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-62410

Vulnerability Analysis

This vulnerability falls under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as Prototype Pollution. The core issue stems from the shared execution context between untrusted scripts and the main application within happy-dom's architecture.

When happy-dom processes JavaScript code, even with the --disallow-code-generation-from-strings flag enabled, the security boundary between trusted and untrusted code is not properly enforced. The flag was intended to prevent dynamic code generation attacks but fails to account for prototype pollution vectors that operate within the same JavaScript Isolate.

Prototype pollution attacks work by manipulating the prototype chain of JavaScript objects, allowing attackers to inject or modify properties that will be inherited by all objects. In the context of happy-dom, this enables attackers to hijack references to critical objects like process, potentially enabling remote code execution in Node.js environments.

Root Cause

The root cause is the incomplete isolation between untrusted JavaScript execution and the application's trusted context. The --disallow-code-generation-from-strings flag addresses only one attack vector (dynamic code generation via eval() and Function constructors) while leaving the prototype chain accessible and modifiable by untrusted code.

This represents an architectural limitation where both execution contexts share the same JavaScript Isolate, making it impossible to fully segregate object prototypes and prevent pollution attacks without more comprehensive sandboxing.

Attack Vector

The attack is network-accessible and requires an attacker to supply malicious JavaScript content that gets processed by happy-dom. The exploitation typically involves:

1. Crafting a JavaScript payload that modifies Object.prototype or other built-in prototypes
2. Injecting properties that will be accessed by the application's trusted code
3. Hijacking critical references (such as process) or manipulating undefined property checks to alter control flow
4. Achieving code execution or other malicious outcomes depending on the application's behavior

The vulnerability is particularly dangerous in scenarios where happy-dom processes user-controlled HTML or JavaScript content, such as server-side rendering of untrusted data or automated testing environments that execute external scripts.

Detection Methods for CVE-2025-62410

Indicators of Compromise

• Unexpected modifications to JavaScript object prototypes in application logs or debugging output
• Unusual property access patterns on Object.prototype or other built-in prototypes
• Attempts to access or modify the process object from untrusted script contexts
• Anomalous control flow behavior indicating manipulated undefined property checks

Detection Strategies

• Monitor for prototype pollution patterns in JavaScript execution, particularly modifications to __proto__, constructor.prototype, or direct Object.prototype assignments
• Implement runtime integrity checks for critical objects like process before sensitive operations
• Deploy application-level logging to detect unexpected property access patterns on prototype chains
• Use static analysis tools to identify potentially vulnerable code paths that process untrusted JavaScript

Monitoring Recommendations

• Enable detailed logging for happy-dom script execution in production environments
• Monitor dependency versions and implement automated alerts for outdated packages
• Track failed security checks or unexpected exceptions that may indicate exploitation attempts
• Implement behavioral analysis to detect anomalous JavaScript execution patterns

How to Mitigate CVE-2025-62410

Immediate Actions Required

• Upgrade happy-dom to version 20.0.2 or later immediately
• Audit applications using happy-dom to identify exposure to untrusted JavaScript content
• Implement additional input validation for any user-controlled data processed by happy-dom
• Consider isolating happy-dom execution in separate processes or containers as a defense-in-depth measure

Patch Information

The vulnerability is fixed in happy-dom version 20.0.2. The security patch addresses the incomplete isolation issue from CVE-2025-61927.

For detailed information about the fix, refer to the GitHub Commit and the GitHub Security Advisory GHSA-qpm2-6cq5-7pq5.

Workarounds

• Avoid processing untrusted JavaScript content with happy-dom until the patch is applied
• Implement prototype freezing by calling Object.freeze(Object.prototype) before executing untrusted code (may break some functionality)
• Run happy-dom in isolated worker threads or separate Node.js processes to limit the impact of prototype pollution
• Use Content Security Policy (CSP) and other input sanitization measures to reduce exposure to malicious scripts

# Upgrade happy-dom to patched version
npm update happy-dom@20.0.2

# Verify installed version
npm list happy-dom