Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34226 Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page orig… https://www.cve.org/CVERecord?id=CVE-2026-34226
Post summary
The post announces CVE‑2026‑34226 for Happy DOM versions before 20.8.9, noting that they may attach cookies from the current page, but offers no PoC, exploit code, or patch information.
CVE-2026-34226 Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead o... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34226
Post summary
The text announces CVE‑2026‑34226, describing a cookie leakage flaw in Happy DOM pre‑20.8.9, but provides no proof‑of‑concept, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | capricorn86 | happy_dom | - | node.js | - |