---
title: Happy DOM CVE-2026-115895: an import-alias injection escapes to the Node.js host when JavaScript evaluation is on; fixed in 21.0.4 | ctxsec
url: https://ctxsec.com/items/happy-dom-cve-2026-115895-esm-alias-rce-21-0-4
description: ""
status: "confirmed (GitHub Advisory Database GHSA-834v-8h66-3h79, published Oct 23; CVSS 3.1 8.8); no exploitation reported"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/happy-dom-cve-2026-115895-esm-alias-rce-21-0-4.md)

confirmed (GitHub Advisory Database GHSA-834v-8h66-3h79, published Oct 23; CVSS 3.1 8.8); no exploitation reported

2026-10-23

### Happy DOM CVE-2026-115895: an import-alias injection escapes to the Node.js host when JavaScript evaluation is on; fixed in 21.0.4

Happy DOM, the browser emulator used by many JavaScript test runners and some SSR and scraping services, has a second code-injection path in its ES module compiler. It's an incomplete fix for **CVE-2026-33943**. A named-import alias isn't validated before it is pasted into generated code, so a crafted `import { x as y = ... }` runs attacker code. The reporter's PoC reached the host's `process` and `node:fs` and wrote to the host filesystem.

- **Affected:** happy-dom 17.0.0 through 21.0.3. **Fixed:** 21.0.4 (published to npm Oct 20; the advisory went public Oct 23).
- **Precondition:** `enableJavaScriptEvaluation: true` plus attacker-controlled HTML or module source. Unit tests on your own code are low risk. Services that render or preview pages supplied by users or agents are the real exposure.
- CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R).

Sources: [GitHub Advisory GHSA-834v-8h66-3h79 (CVE-2026-115895)](https://github.com/advisories/GHSA-834v-8h66-3h79) · [happy-dom on npm](https://www.npmjs.com/package/happy-dom)