Cyber Resilience

CVE-2026-34226

Info Disclosure in Capricorn86 Happy Dom ≤ 20.8.9

Public PoCInfo Disclosure
Published
27 March 2026
Modified
15 July 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0046 38th percentile
Risk Priority 57 floored blend · peak EPSS

Summary

CVE-2026-34226 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Capricorn86 Happy Dom. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-21 (Information Sharing) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Happy DOM, a JavaScript library implementing a web browser environment without a graphical user interface, contains a vulnerability in versions prior to 20.8.9. The flaw causes the library to incorrectly attach cookies from the current page origin (window.location) rather than the request target URL when using fetch with the { credentials: "include" } option. This misbehavior enables unintended cookie leakage from one origin (A) to another (B), violating same-origin policy expectations for credentials. The issue is tracked as CVE-2026-34226 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Entity).

Attackers can exploit this vulnerability remotely without privileges or user interaction by controlling content on a page that uses vulnerable Happy DOM and inducing a fetch request to their target origin with credentials included. For instance, in environments like server-side rendering, testing frameworks (e.g., Jest), or Node.js applications leveraging Happy DOM for DOM manipulation, an attacker could inject malicious JavaScript to trigger the faulty fetch behavior. Successful exploitation allows the attacker to exfiltrate sensitive cookies tied to the victim's origin, potentially enabling session hijacking, account takeover, or further reconnaissance if those cookies hold authentication tokens or other confidential data.

The official GitHub security advisory (GHSA-w4gp-fjgq-3q4g) and release notes for version 20.8.9 detail the patch, which corrects the cookie attachment logic in FetchRequestHeaderUtility.ts via commit 68324c21d7b98f53f7bb5a7b3e185bda7106e751 and pull request #2117. Security practitioners should upgrade to Happy DOM 20.8.9 or later, audit dependencies for vulnerable versions, and review fetch usage in applications relying on this library to ensure credentials are not inadvertently included in cross-origin requests.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })`…

more

is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1025 Data from Removable Media Collection
Adversaries may search connected removable media on computers they have compromised to find files of interest.
T1039 Data from Network Shared Drive Collection
Adversaries may search network shares on computers they have compromised to find files of interest.
T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
T1114 Email Collection Collection
Adversaries may target user email to collect sensitive information.
T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-33943Same product: Capricorn86 Happy Dom
CVE-2025-66035Shared CWE-201, CWE-359
CVE-2024-38103Shared CWE-359
CVE-2025-14317Shared CWE-359
CVE-2026-25699Shared CWE-359
CVE-2025-43496Shared CWE-359
CVE-2025-0679Shared CWE-359
CVE-2024-49025Shared CWE-359
CVE-2025-10859Shared CWE-359
CVE-2023-5983Shared CWE-359

Affected Assets

capricorn86
happy dom
≤ 20.8.9

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V14.2.3
  • V10.3.5
  • V10.7.2

Mitigating Controls (NIST 800-53 r5) AI

Enforces authorizations so that PII is not reachable by unauthorized actors.

Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.

Requires explicit verification that a recipient's authorizations match the sensitivity of shared PII.

Limits granted rights to the minimum needed, reducing the set of actors who can reach private data.

Documents the legal or consent basis required before any processing of PII occurs.

PT-4 Consent good match

Implements consent mechanisms that directly block access absent the individual's permission.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.

DE.CM-09 partial match
prevents

Monitoring runtime data flows and outputs can detect sensitive data being transmitted.

PR.DS-02 partial match
prevents

Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.

PR.DS-10 partial match
prevents

Protecting data-in-use includes removing confidential values before they are processed or sent.

RC.CO-04 partial match
degrades

CWE-359 does not impair RC.CO-04's ability to issue approved public recovery updates, yet any resulting PII exposure can partially undermine the outcome's overall efficacy and trust.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.

prevents

Monitoring and quarantining outbound messages that contain personal or private data directly reduces the chance that such information will be disclosed to unauthorized recipients.

prevents

The explicit prohibition on copying personally identifiable information into development and test environments directly lowers the exposure of private personal data to staff or processes that should not see it.

mitigates

Classification identifies sensitive data so it is not inadvertently transmitted.

mitigates

Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.

mitigates

Information-transfer rules directly govern what data may be sent to external parties.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260531 Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. prevents CWE-359
Ubuntu 24.04 (1 rule)
  • V-270670 Ubuntu 24.04 LTS must configure the SSH client to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission. prevents CWE-359

References