ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (happy-dom)
Highnpm package (happy-dom)

Happy DOM 17 to 21.0.3: a crafted page can run code on the machine running it

Developers who use Happy DOM with JavaScript evaluation turned on to load HTML or scripts they didn't write, such as in server rendering, previews, scraping or test services.

How to fix it

You haveUpdate to
17.0.0 and later, before 21.0.4→21.0.4

Check your version

Which version your project has
npm ls happy-dom

Update

In your project
npm update happy-dom
npm ls happy-dom
Still old? A dependency pins it
npm explain happy-dom
Then check what's left
npm audit

If you can't update yet

The flaw needs enableJavaScriptEvaluation set to true and outside HTML or module source reaching Happy DOM. Until you update, leave JavaScript evaluation off or only give Happy DOM code you trust.

The earlier fix for CVE-2026-33943 left this second path open, so being on a version that has that fix isn't enough.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources