fix(deps): update dependency happy-dom to v20 [security] #7729

renovate · 2025-10-11T02:14:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`^18.0.1` -> `^20.0.0`

GitHub Vulnerability Alerts

CVE-2025-61927

Escape of VM Context gives access to process level functionality

Summary

Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

What the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Reproduce

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
     const require = process.mainModule.require;
  
     console.log('Files:', require('fs').readdirSync('.').slice(0,3));
  </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
  
     console.log('PID:', process.pid);
  </script>
`);

Potential Impact

Server-Side Rendering (SSR)

const { Window } = require('happy-dom');
const window = new Window();
window.document.innerHTML = userControlledHTML;

Testing Frameworks

Any test suite using Happy-DOM with untrusted content may be at risk.

Attack Scenarios

Data Exfiltration: Access to environment variables, configuration files, secrets
Lateral Movement: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.).
Code Execution: Child process access for running arbitrary commands
Persistence: File system access

Recommended Immediate Actions

Update Happy DOM to v20 or above
- This version has JavaScript evaluation disabled by default
- This version will output a warning if JavaScript is enabled in an insecure environment
Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled
- This makes sure that evaluation can't be used at process level to escape the VM
- eval() and Function() can still be used within the Happy DOM VM without any known security risk
- Happy DOM v20 and above will output a warning if this flag is not in use
If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment

Technical Root Cause

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

Running Node with the "--disallow-code-generation-from-strings" flag protects against this.

Release Notes

capricorn86/happy-dom (happy-dom)

`v20.0.0`

Compare Source

`v19.0.2`

Compare Source

👷‍♂️ Patch fixes

Fixes issue related to CSS pseudo selector :scope that didn't work correctly for direct descendants to root - By @capricorn86 in task #1620

`v19.0.1`

Compare Source

👷‍♂️ Patch fixes

Fixes issue with sending in URLs as string in @happy-dom/server-renderer config using CLI - By @capricorn86 in task #1908

`v19.0.0`

Compare Source

💣 Breaking Changes

Removes support for CommonJS - By @capricorn86 in task #1730
- Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using require()
Updates Jest to v30 in the @happy-dom/jest-environment package - By @capricorn86 in task #1730
Makes Jest packages peer dependencies to make it easier to align versions with the project using @happy-dom/jest-environment - By @capricorn86 in task #1730

🎨 Features

Adds a new package called @happy-dom/server-renderer - By @capricorn86 in task #1730
- This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application
- Read more in the Wiki under Server-Renderer
Adds support for import.meta to the ESM compiler - By @capricorn86 in task #1730
Adds support for the CSS pseudo selector :scope - By @capricorn86 in task #1620
Improves support for MediaList - By @capricorn86 in task #1730
Adds support for CSSKeywordValue, CSSStyleValue, StylePropertyMap, StylePropertyMap, StylePropertyMapReadOnly - By @capricorn86 in task #1730
Improves debug information in the ESM compiler - By @capricorn86 in task #1730
Adds validation of browser settings when creating a new Browser instance - By @capricorn86 in task #1730
Adds support for the browser setting navigation.beforeContentCallback which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By @capricorn86 in task #1730
Adds support for the browser setting fetch.requestHeaders which provides with a declarative and simple way to add request headers - By @capricorn86 in task #1730
Adds support for setting an object to timer.preventTimerLoops which makes it possible to define different settings for setTimeout() and requestAnimationFrame() - By @capricorn86 in task #1730
Adds support for the browser setting viewport which makes it possible to define a default viewport size - By @capricorn86 in task #1730
Adds support for the parameters beforeContentCallback and headers to BrowserFrame.goto(), BrowserFrame.goBack(), BrowserFrame.goForward(), BrowserFrame.goSteps() and BrowserFrame.reload() - By @capricorn86 in task #1730
Adds support for PopStateEvent and trigger the event when navigating the page history using History.pushState() - By @capricorn86 in task #1730
Use local file paths for virtual server files in stack traces - By @capricorn86 in task #1730
Adds support for ResponseCache.fileSystem.load() and ResponseCache.fileSystem.save() for storing and loading cache from the file system - By @capricorn86 in task #1730

👷‍♂️ Patch fixes

Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By @capricorn86 in task #1730
Disables the same origin policy when navigating a browser frame using BrowserFrame.goto() - By @capricorn86 in task #1730
Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By @capricorn86 in task #1730
Adds try and catch to listeners for events dispatched from XMLHttpRequest to prevent it from being set to an invalid state if a listener throws an Error - By @capricorn86 in task #1730

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Gibraltar, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2025-10-11T02:14:53Z

⚠️ No Changeset found

Latest commit: db628ff

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

fix(deps): update dependency happy-dom to v20 [security]

db628ff

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 7f6b48a to db628ff Compare October 13, 2025 06:37

ematipico merged commit c7f9085 into main Oct 13, 2025
5 checks passed

ematipico deleted the renovate/npm-happy-dom-vulnerability branch October 13, 2025 11:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(deps): update dependency happy-dom to v20 [security] #7729

fix(deps): update dependency happy-dom to v20 [security] #7729

renovate bot commented Oct 11, 2025

Uh oh!

changeset-bot bot commented Oct 11, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

fix(deps): update dependency happy-dom to v20 [security] #7729

fix(deps): update dependency happy-dom to v20 [security] #7729

Conversation

renovate bot commented Oct 11, 2025

GitHub Vulnerability Alerts

CVE-2025-61927

Escape of VM Context gives access to process level functionality

Summary

Reproduce

CommonJS (Possible to get hold of require)

ESM (Not possible to get hold of import or require)

Potential Impact

Server-Side Rendering (SSR)

Testing Frameworks

Attack Scenarios

Recommended Immediate Actions

Technical Root Cause

Release Notes

v20.0.0

v19.0.2

👷‍♂️ Patch fixes

v19.0.1

👷‍♂️ Patch fixes

v19.0.0

💣 Breaking Changes

🎨 Features

👷‍♂️ Patch fixes

Configuration

Uh oh!

changeset-bot bot commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v20.0.0`

`v19.0.2`

`v19.0.1`

`v19.0.0`

changeset-bot bot commented Oct 11, 2025 •

edited

Loading