chore(deps): update dev dependency happy-dom to v20 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	^6.0.4 → ^20.0.0

GitHub Vulnerability Alerts

CVE-2024-51757

Impact

Consumers of the NPM package happy-dom

Patches

The security vulnerability has been patched in v15.10.2

Workarounds

No easy workarounds to my knowledge

References

#​1585

CVE-2025-61927

Escape of VM Context gives access to process level functionality

Summary

Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Reproduce

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
     const require = process.mainModule.require;
  
     console.log('Files:', require('fs').readdirSync('.').slice(0,3));
  </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
  
     console.log('PID:', process.pid);
  </script>
`);

Potential Impact

Server-Side Rendering (SSR)

const { Window } = require('happy-dom');
const window = new Window();
window.document.innerHTML = userControlledHTML;

Testing Frameworks

Any test suite using Happy-DOM with untrusted content may be at risk

Attack Scenarios

1. Data Exfiltration: Access to environment variables, configuration files, secrets
2. Lateral Movement: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.).
3. Code Execution: Child process access for running arbitrary commands
4. Persistence: File system access

Recommended Immediate Actions

1. Update Happy DOM to v20 or above
   • This version has JavaScript evaluation disabled by default
   • This version will output a warning if JavaScript is enabled in an insecure environment
2. Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled
   • This makes sure that evaluation can't be used at process level to escape the VM
   • eval() and Function() can still be used within the Happy DOM VM without any known security risk
   • Happy DOM v20 and above will output a warning if this flag is not in use
3. If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment

Technical Root Cause

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

Running Node with the "--disallow-code-generation-from-strings" flag protects against this.

---

Release Notes

capricorn86/happy-dom (happy-dom)

v20.8.3

Compare Source

👷‍♂️ Patch fixes

• Throw error if event is not of type Event in dispatchEvent - By @​capricorn86 in task #​2054

v20.8.2

Compare Source

👷‍♂️ Patch fixes

• Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @​capricorn86 in task #​2090

v20.8.1

Compare Source

👷‍♂️ Patch fixes

• Make "inert" attribute block focus interactions - By @​coffeeandwork in task #​1422

v20.8.0

Compare Source

v20.7.2

Compare Source

👷‍♂️ Patch fixes

• Properly decode CSS escape sequences in attribute selector values - By @​silverwind

v20.7.1

Compare Source

v20.7.0

Compare Source

🎨 Features

• Adds support for Window.getScreenDetails() - By @​TrevorBurnham in task #​1923
• Extends Screen from EventTarget - By @​TrevorBurnham in task #​1923

v20.6.5

Compare Source

👷‍♂️ Patch fixes

• Add clearImmediate to Jest environment global scope - By @​TrevorBurnham in task #​1927

v20.6.4

Compare Source

👷‍♂️ Patch fixes

• Normalize invalid input type attribute to "text" per HTML spec - By @​atzzCokeK in task #​2053

v20.6.3

Compare Source

👷‍♂️ Patch fixes

• Refactors query selector parser to be able to handle complex rules - By @​capricorn86 in task #​1910
• Fixes issue related to using query selector for attribute in XML document - By @​capricorn86 in task #​1912
• Fixes issue with using quotes within quotes for attribute query selector (e.g. [data-value="it's a test"]) - By @​capricorn86 in task #​2034

v20.6.2

Compare Source

👷‍♂️ Patch fixes

• Update entities package version to resolve missing export for vue and vue-compat v3.5 - By @​acollins1991 in task #​2066

v20.6.1

Compare Source

v20.6.0

Compare Source

v20.5.5

Compare Source

v20.5.4

Compare Source

👷‍♂️ Patch fixes

• Implement Text.wholeText property - By @​aki05162525 in task #​1959

v20.5.3

Compare Source

v20.5.2

Compare Source

v20.5.1

Compare Source

v20.5.0

Compare Source

v20.4.0

Compare Source

🎨 Features

• Adds support for caching the compiled code of EcmaScript modules - By @​capricorn86 in task #​2049
• Improves the way nodes are destroyed and garbage collected - By @​capricorn86 in task #​2049

v20.3.9

Compare Source

👷‍♂️ Patch fixes

• Accept Document nodes as valid boundary points in Selection API - By @​skoch13 in task #​1952

v20.3.8

Compare Source

👷‍♂️ Patch fixes

• The getters for the properties focusNode and focusOffset in the Selection API returned incorrect values - By @​skoch13 in task #​1850

v20.3.7

Compare Source

👷‍♂️ Patch fixes

• Updates README.md for the "@​happy-dom/server-renderer" package - By @​capricorn86 in task #​2035

v20.3.6

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where it wasn't possible to toggle the "open" attribute of <details> by clicking on a child of the <summary> element - By @​Nxooah in task #​1928

v20.3.5

Compare Source

👷‍♂️ Patch fixes

• Use internal property for "location" in BrowserFrameURL to avoid mock interference - By @​marchaos in task #​1964
• Add optional chaining to the "hostname" and pathname" properties to check if they are undefined in CookieURLUtility - By @​marchaos in task #​1968

v20.3.4

Compare Source

v20.3.3

Compare Source

v20.3.2

Compare Source

v20.3.1

Compare Source

👷‍♂️ Patch fixes

• Normalizes the "format" parameter according to the HTML specification in DataTransfer.getData() - By @​marchaos in task #​1965
• Handle partial responses in XMLHttpRequest - By @​rexxars in task #​1890

v20.3.0

Compare Source

🎨 Features

• Use RegExp to convert ASCII character casing to improve performance - By @​TrevorBurnham in task #​1886

v20.2.0

Compare Source

🎨 Features

• Use Element.classList.contains() instead of splitting className in query selectors to improve performance as it's cached - By @​TrevorBurnham in task #​1884

v20.1.1

Compare Source

👷‍♂️ Patch fixes

• Fixes caching in querySelector() - By @​TrevorBurnham in task #​1882
• Avoid sort in querySelector() to improve performance - By @​TrevorBurnham in task #​1882

v20.1.0

Compare Source

🎨 Features

• Adds support for BrowserPage.evaluateModule() and BrowserFrame.evaluateModule() - By @​capricorn86 in task #​1944
• Adds support for module to the browser settings - By @​capricorn86 in task #​1944
  • This makes it possible to add a custom resolver or a node module resolver
• Adds support for dynamic import() to JavaScript evaluation - By @​capricorn86 in task #​1944
  • It was previously only supported when using type="module" on script elements
• Adds support for WebSocket - By @​capricorn86 in task #​1944
• Adds support for CloseEvent - By @​capricorn86 in task #​1944
• Adds support for render.setupScript and render.mode to the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Changes name from urls to renderItems in the configuration in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Adds support for rendering strings in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944
• Makes JavaScript evaluation disabled by default in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

👷‍♂️ Patch fixes

• Several fixed to the EcmaScript module compiler (esm) - By @​capricorn86 in task #​1944
• Fixes issue where rendering using Worker's didn't work in @​happy-dom/server-renderer - By @​capricorn86 in task #​1944

v20.0.11

Compare Source

v20.0.10

Compare Source

v20.0.9

Compare Source

v20.0.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where previousSibling() and nextSibling() didn't work in HTMLSelectElement and HTMLFormElement - By @​capricorn86 in task #​1939
• Fixes issue where parsing an item without a permitted parent (e.g. <tr>) should be valid inside a <template> element - By @​capricorn86 in task #​1939

v20.0.7

Compare Source

👷‍♂️ Patch fixes

• Fix incorrect handling of >= operator in media query parser - By @​lkritsimas in task #​1869

v20.0.6

Compare Source

👷‍♂️ Patch fixes

• Changes implementation for DOMTokenList.forEach(), Headers.forEach() and NodeList.forEach() to be spec compliant - By @​ikeyan in task #​1858

v20.0.5

Compare Source

👷‍♂️ Patch fixes

• The setter TreeWalker.currentNode should validate if the value is a Node - By @​capricorn86 in task #​1935

v20.0.4

Compare Source

👷‍♂️ Patch fixes

• Only adds buttons to FormData if they are the submitter - By @​maxmil and @​
  karpiuMG in task #​1859

v20.0.3

Compare Source

👷‍♂️ Patch fixes

• Moves URL resolution to after checking if module preloading is enabled to prevent URL errors to be thrown when unresolvable - By @​iam-medvedev in task #​1851
• Fixes issue where CSS variables aren't parsed correctly when inside CSS functions - By @​fimion in task #​1837

v20.0.2

Compare Source

👷‍♂️ Patch fixes

• Adds frozen intrinsics flag to workers in @happy-dom/server-renderer - By @​capricorn86 in task #​1934

v20.0.1

Compare Source

👷‍♂️ Patch fixes

• Adds warning for environment with unfrozen intrinsics (builtins) when JavaScript evaluation is enabled- By @​capricorn86 in task #​1932
  • A security advisory has been reported showing that the recommended preventive measure of running Node.js with --disallow-code-generation-from-strings wasn't enough to protect against attackers escaping the VM context and accessing process-level functions. Big thanks to @​cristianstaicu for reporting this!
  • The documentation for how to run Happy DOM with JavaScript evaluation enabled in a safer way has been updated. Read more about it in the Wiki

v20.0.0

Compare Source

I avoid making breaking changes as much as possible in Happy DOM. When I have to make a breaking change, I try to keep it as minimal as possible. This could be a breaking change that impacts many projects, and I am truly sorry if you are negatively affected by this.

💣 Breaking Changes

• Due to security risks, JavaScript evaluation is now disabled by default - By @​capricorn86 in task #​1930
  • A security advisory (GHSA-37j7-fg3j-429f) has been reported that shows a security vulnerability where it's possible to escape the VM context and get access to process level functionality. Big thanks to @​Mas0nShi for reporting this!
  • Due to this security risk, JavaScript evaluation is now disabled by default to prevent that consumers accidentally executes untrusted code without taking precautions
  • JavaScript evaluation can be enabled by setting enableJavaScriptEvaluation to "true". Read more about how to enable this in a safer way in the Wiki

v19.0.2

Compare Source

👷‍♂️ Patch fixes

• Fixes issue related to CSS pseudo selector :scope that didn't work correctly for direct descendants to root - By @​capricorn86 in task #​1620

v19.0.1

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with sending in URLs as string in @happy-dom/server-renderer config using CLI - By @​capricorn86 in task #​1908

v19.0.0

Compare Source

💣 Breaking Changes

• Removes support for CommonJS - By @​capricorn86 in task #​1730
  • Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using require()
• Updates Jest to v30 in the @happy-dom/jest-environment package - By @​capricorn86 in task #​1730
• Makes Jest packages peer dependencies to make it easier to align versions with the project using @happy-dom/jest-environment - By @​capricorn86 in task #​1730

🎨 Features

• Adds a new package called @happy-dom/server-renderer - By @​capricorn86 in task #​1730
  • This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application
  • Read more in the Wiki under Server-Renderer
• Adds support for import.meta to the ESM compiler - By @​capricorn86 in task #​1730
• Adds support for the CSS pseudo selector :scope - By @​capricorn86 in task #​1620
• Improves support for MediaList - By @​capricorn86 in task #​1730
• Adds support for CSSKeywordValue, CSSStyleValue, StylePropertyMap, StylePropertyMap, StylePropertyMapReadOnly - By @​capricorn86 in task #​1730
• Improves debug information in the ESM compiler - By @​capricorn86 in task #​1730
• Adds validation of browser settings when creating a new Browser instance - By @​capricorn86 in task #​1730
• Adds support for the browser setting navigation.beforeContentCallback which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By @​capricorn86 in task #​1730
• Adds support for the browser setting fetch.requestHeaders which provides with a declarative and simple way to add request headers - By @​capricorn86 in task #​1730
• Adds support for setting an object to timer.preventTimerLoops which makes it possible to define different settings for setTimeout() and requestAnimationFrame() - By @​capricorn86 in task #​1730
• Adds support for the browser setting viewport which makes it possible to define a default viewport size - By @​capricorn86 in task #​1730
• Adds support for the parameters beforeContentCallback and headers to BrowserFrame.goto(), BrowserFrame.goBack(), BrowserFrame.goForward(), BrowserFrame.goSteps() and BrowserFrame.reload() - By @​capricorn86 in task #​1730
• Adds support for PopStateEvent and trigger the event when navigating the page history using History.pushState() - By @​capricorn86 in task #​1730
• Use local file paths for virtual server files in stack traces - By @​capricorn86 in task #​1730
• Adds support for ResponseCache.fileSystem.load() and ResponseCache.fileSystem.save() for storing and loading cache from the file system - By @​capricorn86 in task #​1730

👷‍♂️ Patch fixes

• Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By @​capricorn86 in task #​1730
• Disables the same origin policy when navigating a browser frame using BrowserFrame.goto() - By @​capricorn86 in task #​1730
• Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By @​capricorn86 in task #​1730
• Adds try and catch to listeners for events dispatched from XMLHttpRequest to prevent it from being set to an invalid state if a listener throws an Error - By @​capricorn86 in task #​1730

v18.0.1

Compare Source

👷‍♂️ Patch fixes

• Addresses an issue where an error occurred if the Element ID was set to the same name as a Window property with a null value - By @​capricorn86 in task #​1841

v18.0.0

Compare Source

💣 Breaking Changes

• Makes the types for Happy DOM strict - By @​capricorn86 in task #​1154
  • This makes it possible to use the option skipLibCheck set to "false" in the typescript configuration for projects with a strict configuration
  • This change has resulted in that some types has changed and is therefore considered as a breaking change
• BrowserContext.close() now throws an error when trying to close the default context of a browser - By @​capricorn86 in task #​1154

🎨 Features

• Adds support for Browser.closed, BrowserContext.closed, BrowserPage.closed and BrowserFrame.closed - By @​capricorn86 in task #​1154
• Adds support for VirtualConsolePrinter.close() and VirtualConsolePrinter.closed - By @​capricorn86 in task #​1154
• Adds support for CookieContainer.clearCookies() - By @​capricorn86 in task #​1154

v17.6.3

Compare Source

👷‍♂️ Patch fixes

• Removes global typescript definition that was used for custom elements - By @​capricorn86 in task #​1154

v17.6.2

Compare Source

👷‍♂️ Patch fixes

• Updates Typescript to the latest version - By @​capricorn86 in task #​1154

v17.6.1

Compare Source

🎨 Features

• Adds support for disabling validation of certificates, to allow for self-signed certificates to be used - By @​capricorn86 in task #​1763
  • Read more about the new setting fetch.disableStrictSSL under IBrowserSettings in the Wiki

v17.6.0

Compare Source

v17.5.9

Compare Source

👷‍♂️ Patch fixes

• Adds missing null check in HTMLLinkElement for a browser frame property that becomes null during teardown of a Window - By @​capricorn86 in task #​1800

v17.5.8

Compare Source

👷‍♂️ Patch fixes

• Incorrect cache matching caused Element.classList to return the wrong items - By @​capricorn86 in task #​1812

v17.5.7

Compare Source

👷‍♂️ Patch fixes

• Handle wider range of valid characters in unquoted attribute value parsing - By @​AudunWA in task #​1817

v17.5.6

Compare Source

👷‍♂️ Patch fixes

• Removes the min and max boundary check when setting the value of an input field of type "date" - By @​zgrybus in task #​1815

v17.5.5

Compare Source

v17.5.4

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where the body of a ReadableStream was locked after being cloned - By @​MarcMcIntosh in task #​1493

v17.5.3

Compare Source

👷‍♂️ Patch fixes

• Adds previousSibling and nextSibling to MutationObserver records when a child is removed - By @​uxuip in task #​1803

v17.5.2

Compare Source

👷‍♂️ Patch fixes

• Adds support for the unicode characters « and » in query selectors used by the React 19.1 "useId" hook - By @​terrymun in task #​1785

v17.5.1

Compare Source

👷‍♂️ Patch fixes

• Existing URL query string should be overwritten on form submit when method is "GET" - By @​rslabbert in task #​1786

v17.5.0

Compare Source

🎨 Features

• Adds support for XMLHttpRequest.overrideMimeType() - By @​maxmil in task #​1782

v17.4.9

Compare Source

👷‍♂️ Patch fixes

• A disabled input element should not be parsed in FormData - By @​juandiegombr in task #​1790

v17.4.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where CSS variables where not being parsed in color functions - By @​hampustagerud in task #​1822

v17.4.7

Compare Source

👷‍♂️ Patch fixes

• Allow empty URL string in Request - By @​elierotenberg in task #​1779

v17.4.6

Compare Source

👷‍♂️ Patch fixes

• Preserve slashes in the "name" property in File - By @​dyabol in task #​1788

v17.4.5

Compare Source

👷‍♂️ Patch fixes

• Handle bubbling click events in HTMLAnchorElement - By @​maxmil in task #​1775

v17.4.4

Compare Source

👷‍♂️ Patch fixes

• Sets 0 instead of undefined as default in setTimeout() to prevent Bun from logging a "TimeoutNaNWarning" - By @​lekoala in task #​1772

v17.4.3

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where the wrong scope was used when settings.errorCapture is not set to "tryAndCatch" and handleEvent is used for the event listener - By @​capricorn86 in task #​1766

v17.4.2

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where an error was thrown for "xmlns" or unknown prefixes in Element.setAttribute() - By @​capricorn86 in task #​1750

v17.4.1

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where an error was thrown for attributes "xlink" or an unknown prefix during parsing of HTML - By @​capricorn86 in task #​1750

v17.4.0

Compare Source

🎨 Features

• Adds support for the KeyboardEvent.getModifierState() method - By @​karpiuMG in task #​1467

v17.3.2

Compare Source

👷‍♂️ Patch fixes

• Escapes special regex characters in attribute selectors - By @​karpiuMG in task #​1697

v17.3.1

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where an error was thrown for attributes with "xmlns" as prefix during parsing of HTML (e.g. <svg xmlns:link=""></svg>) - By @​capricorn86 in task #​1750

v17.3.0

Compare Source

🎨 Features

• Adds support for form method 'dialog' - By @​karpiuMG in task #​1184

v17.2.4

Compare Source

👷‍♂️ Patch fixes

• SVG elements should be skipped in HTMLElement.innerText - By @​karpiuMG in task #​1151

v17.2.3

Compare Source

👷‍♂️ Patch fixes

• Element.contentEditable should be synced with the "contenteditable" attribute - By @​karpiuMG in task #​1463

v17.2.2

Compare Source

👷‍♂️ Patch fixes

• Handle invalid indices on Node.childNodes - By @​karpiuMG in task #​1698

v17.2.1

Compare Source

👷‍♂️ Patch fixes

• Handle nested square brackets and parentheses inside pseudo-class arguments - By @​karpiuMG in task #​1072

v17.2.0

Compare Source

🎨 Features

• Add support for multiple selectors in ":not" pseudo-class - By @​karpiuMG in task #​990

v17.1.13

Compare Source

👷‍♂️ Patch fixes

• Allow to use secure flag for cookies on "http://localhost" - By @​karpiuMG in task #​1162

v17.1.12

Compare Source

👷‍♂️ Patch fixes

• Adds event phases as static properties on Event class - By @​alan910127 in task #​1747

v17.1.11

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with attribute references when using Element.cloneNode() - By @​Mas0nShi in task #​1745

v17.1.10

Compare Source

👷‍♂️ Patch fixes

• Prevents disabled inputs from being focused or blurred - By @​karpiuMG in task #​1563

v17.1.9

Compare Source

👷‍♂️ Patch fixes

• Event listener properties prefixed with "on" should be the evaluated value of the corresponding attribute - By @​capricorn86 in task #​474

v17.1.8

Compare Source

👷‍♂️ Patch fixes

• Fixes issue where change event wasn't triggered for an input inside of a label - By @​capricorn86 in task #​1614

v17.1.7

Compare Source

👷‍♂️ Patch fixes

• Adds missing end boundary to FormData requests - By @​aberigle and @​capricorn86 in task #​1741

v17.1.6

Compare Source

🎨 Features

• Adds support for sending AbortSignal as option to EventTarget.addEventListener() - By @​karpiuMG in task #​1540

v17.1.5

Compare Source

:construction

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.