{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "capricorn86 happy-dom: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/capricorn86--happy-dom/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/capricorn86--happy-dom/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115895/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115895/",
   "title": "CVE-2026-115895 · capricorn86 happy-dom · disclosed",
   "content_text": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.",
   "date_published": "2026-10-23T21:32:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115895/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115895/",
   "title": "CVE-2026-115895 · capricorn86 happy-dom · fixed upstream (npm)",
   "content_text": "Fixed versions: happy-dom 21.0.4.",
   "date_published": "2026-10-23T21:32:24Z"
  }
 ]
}