---
title: Tip: if any service runs Happy DOM on HTML it didn't write, upgrade to 21.0.4 and keep JavaScript evaluation off | ctxsec
url: https://ctxsec.com/items/tip-happy-dom-js-evaluation-untrusted-html
description: ""
status: "guidance based on GitHub advisory GHSA-834v-8h66-3h79"
published: 2026-10-24
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-happy-dom-js-evaluation-untrusted-html.md)

guidance based on GitHub advisory GHSA-834v-8h66-3h79

2026-10-24

### Tip: if any service runs Happy DOM on HTML it didn't write, upgrade to 21.0.4 and keep JavaScript evaluation off

- Find it: `npm ls happy-dom` or `pnpm why happy-dom` in each repo, and search SBOMs. It often arrives as a dependency of test runners or SSR or preview tools.
- Upgrade to **21.0.4** or later. Versions 17.0.0 through 21.0.3 are affected.
- Search for `enableJavaScriptEvaluation: true`. If you set it only for tests on your own fixtures, the risk is low. If it processes user-, crawler- or agent-supplied pages, treat it as remote code execution and run that worker in a sandbox with no secrets in its environment.
- Happy DOM is not a security sandbox. For hostile pages, use a real isolated browser.

Sources: [GitHub Advisory GHSA-834v-8h66-3h79](https://github.com/advisories/GHSA-834v-8h66-3h79)