CVE-2026-34226: Capricorn86 Happy Dom XSS Vulnerability

CVE-2026-34226 Overview

CVE-2026-34226 is an Information Leakage vulnerability in Happy DOM, a JavaScript implementation of a web browser without its graphical user interface. The vulnerability exists in versions prior to 20.8.9 where the library incorrectly handles cookie attachment during fetch requests with credentials: "include". Instead of attaching cookies from the request target URL, Happy DOM attaches cookies from the current page origin (window.location), potentially leaking sensitive authentication cookies from one origin to another.

Critical Impact

This vulnerability enables cross-origin cookie leakage, potentially exposing session tokens and authentication credentials from origin A to a malicious destination B when developers use the fetch API with credential inclusion.

Affected Products

• capricorn86 happy_dom versions prior to 20.8.9
• Happy DOM Node.js package (cpe:2.3:a:capricorn86:happy_dom:*:*:*:*:*:nodejs:*:*)

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-34226 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34226

Vulnerability Analysis

The vulnerability stems from improper cookie handling in Happy DOM's fetch implementation. When a developer makes a fetch request with the credentials: "include" option, the browser-like environment should attach cookies that belong to the target URL's origin. However, the vulnerable versions of Happy DOM incorrectly reference window.location (the current page's origin) instead of the actual request destination when determining which cookies to include.

This behavior violates the same-origin policy expectations that developers rely on when working with browser-simulating environments. The flaw is particularly concerning in server-side rendering (SSR) scenarios, testing environments, and Node.js applications that use Happy DOM to simulate browser behavior.

Root Cause

The root cause lies in the FetchRequestHeaderUtility.ts file within the Happy DOM codebase. The cookie attachment logic incorrectly uses the window's location to determine which cookies should be sent with outgoing requests, rather than inspecting the actual target URL of the fetch request. This logic error means that when code running in Happy DOM's simulated browser context makes cross-origin requests with credentials included, the wrong set of cookies gets attached to the outgoing request headers.

Attack Vector

The attack vector is network-based and requires no user interaction or special privileges. An attacker could exploit this vulnerability in scenarios where:

1. A Happy DOM environment is used to process user-controlled content or URLs
2. The application makes fetch requests with credentials: "include" to external destinations
3. The attacker controls or can influence the destination URL

In such scenarios, cookies from the current origin (which may contain session tokens, authentication credentials, or other sensitive data) would be incorrectly sent to the attacker-controlled destination. The vulnerability enables complete confidentiality breach of cookie data without requiring any complexity in the attack execution.

Detection Methods for CVE-2026-34226

Indicators of Compromise

• Unexpected cookie headers appearing in outgoing HTTP requests to third-party domains
• Session tokens or authentication cookies being transmitted to destinations outside the expected application domain
• Anomalous cross-origin requests containing credentials that should only be sent to the application's own servers
• Log entries showing cookie data being sent to unexpected URLs when using Happy DOM

Detection Strategies

• Audit application dependencies to identify Happy DOM versions prior to 20.8.9
• Review network traffic logs for fetch requests where cookie domains don't match the request destination
• Implement monitoring for cross-origin requests that include credentials in Happy DOM-based applications
• Use Software Composition Analysis (SCA) tools to flag vulnerable Happy DOM versions in your dependency tree

Monitoring Recommendations

• Enable verbose logging for all outgoing fetch requests in Happy DOM environments
• Monitor for authentication failures or session anomalies that could indicate cookie theft
• Implement Content Security Policy (CSP) reporting to detect unexpected outbound connections
• Set up alerts for any npm package updates that affect Happy DOM in production environments

How to Mitigate CVE-2026-34226

Immediate Actions Required

• Upgrade Happy DOM to version 20.8.9 or later immediately
• Audit all applications using Happy DOM to determine if fetch(..., { credentials: "include" }) patterns are used
• Review logs for any potential cookie leakage that may have occurred before the patch
• Rotate session tokens and authentication credentials for applications that may have been affected

Patch Information

The vulnerability has been fixed in Happy DOM version 20.8.9. The fix ensures that cookies are correctly attached based on the request target URL rather than the current page origin. The patch details can be found in the GitHub Commit, and the related discussion is available in the GitHub Pull Request. For complete details, review the GitHub Security Advisory GHSA-w4gp-fjgq-3q4g.

Workarounds

• Avoid using credentials: "include" in fetch requests within Happy DOM until the patch is applied
• Implement server-side validation to ensure cookies are only accepted from expected origins
• Use explicit cookie management instead of relying on automatic cookie inclusion
• Consider temporarily switching to alternative browser simulation libraries if immediate patching is not feasible

# Upgrade Happy DOM to patched version
npm update happy-dom@20.8.9

# Verify installed version
npm list happy-dom

# Alternative: Update package.json to require minimum patched version
# "happy-dom": ">=20.8.9"