Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-34226 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Capricorn86 Happy Dom. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-21 (Information Sharing) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Happy DOM, a JavaScript library implementing a web browser environment without a graphical user interface, contains a vulnerability in versions prior to 20.8.9. The flaw causes the library to incorrectly attach cookies from the current page origin (window.location) rather than the request target URL when using fetch with the { credentials: "include" } option. This misbehavior enables unintended cookie leakage from one origin (A) to another (B), violating same-origin policy expectations for credentials. The issue is tracked as CVE-2026-34226 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Entity).
Attackers can exploit this vulnerability remotely without privileges or user interaction by controlling content on a page that uses vulnerable Happy DOM and inducing a fetch request to their target origin with credentials included. For instance, in environments like server-side rendering, testing frameworks (e.g., Jest), or Node.js applications leveraging Happy DOM for DOM manipulation, an attacker could inject malicious JavaScript to trigger the faulty fetch behavior. Successful exploitation allows the attacker to exfiltrate sensitive cookies tied to the victim's origin, potentially enabling session hijacking, account takeover, or further reconnaissance if those cookies hold authentication tokens or other confidential data.
The official GitHub security advisory (GHSA-w4gp-fjgq-3q4g) and release notes for version 20.8.9 detail the patch, which corrects the cookie attachment logic in FetchRequestHeaderUtility.ts via commit 68324c21d7b98f53f7bb5a7b3e185bda7106e751 and pull request #2117. Security practitioners should upgrade to Happy DOM 20.8.9 or later, audit dependencies for vulnerable versions, and review fetch usage in applications relying on this library to ensure credentials are not inadvertently included in cross-origin requests.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16893
Vulnerability Data
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })`…
more
is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V14.2.3V10.3.5V10.7.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that PII is not reachable by unauthorized actors.
Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.
Requires explicit verification that a recipient's authorizations match the sensitivity of shared PII.
Limits granted rights to the minimum needed, reducing the set of actors who can reach private data.
Documents the legal or consent basis required before any processing of PII occurs.
Implements consent mechanisms that directly block access absent the individual's permission.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.
Protecting data-in-use includes removing confidential values before they are processed or sent.
CWE-359 does not impair RC.CO-04's ability to issue approved public recovery updates, yet any resulting PII exposure can partially undermine the outcome's overall efficacy and trust.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
Monitoring and quarantining outbound messages that contain personal or private data directly reduces the chance that such information will be disclosed to unauthorized recipients.
The explicit prohibition on copying personally identifiable information into development and test environments directly lowers the exposure of private personal data to staff or processes that should not see it.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Information-transfer rules directly govern what data may be sent to external parties.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260531 Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. prevents CWE-359
Ubuntu 24.04 (1 rule)
- V-270670 Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. prevents CWE-359