CVE-2026-34226: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34226 is a cookie leakage vulnerability in Happy DOM, a JavaScript implementation of a headless web browser used primarily in server-side rendering, testing, and proxy-like scenarios. In versions prior to 20.8.9, the library incorrectly attaches cookies from the current page origin (window.location) instead of the request target URL when fetch(..., { credentials: "include" }) is invoked, potentially leaking session cookies from origin A to an unintended destination B. The vulnerability was reported by researcher r74tech, disclosed via GitHub Security Advisory GHSA-w4gp-fjgq-3q4g on March 26, 2026, and patched the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause lies in FetchRequestHeaderUtility.getRequestHeaders() within packages/happy-dom/src/fetch/utilities/FetchRequestHeaderUtility.ts, where cookie selection uses originURL (derived from window.location.href) rather than the actual request destination URL (options.request[PropertySymbol.url]). This means that when a cross-origin fetch is made with credentials: "include", the cookie container is queried with the page's own origin, causing page-origin cookies to be forwarded to the target server instead of the target-origin cookies. The flaw is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The fix, applied in commit 68324c2, changes the cookie lookup to use options.request[PropertySymbol.url] as the URL parameter (GitHub Advisory, Fix Commit).

Successful exploitation results in cross-origin sensitive information disclosure, specifically the leakage of session cookies and authentication tokens from one origin to an attacker-controlled or unintended destination. Applications relying on Happy DOM for SSR, testing pipelines, or proxy-like fetch behavior in authenticated flows are most at risk, as their users' session credentials could be silently forwarded to a third-party server. There is no integrity or availability impact; the confidentiality impact is rated High due to the potential exposure of authentication material (GitHub Advisory).

A standalone, runnable proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the cookie leakage by setting up two local HTTP servers with different origins and confirming that page-origin cookies are sent to the target API instead of target-origin cookies (GitHub Advisory). No user interaction is required, and no special privileges are needed to trigger the vulnerability. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of active exploitation in the wild. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog.

1. Identify a vulnerable application: Locate a Node.js application using Happy DOM version ≤ 20.8.8 that performs server-side fetch() calls with credentials: "include" across different origins (e.g., SSR frameworks, test runners, or proxy services).
2. Set up attacker-controlled server: Deploy an HTTP server at a domain (destination B) that logs incoming Cookie request headers to capture any leaked credentials.
3. Trigger a cross-origin fetch: Craft or influence the vulnerable application so that a Happy DOM browser context with cookies set for origin A (e.g., page_cookie=SESSION_TOKEN) makes a fetch("http://destination-b.example.com/api", { credentials: "include" }) call.
4. Observe cookie leakage: Because Happy DOM queries the cookie container using window.location (origin A's URL) instead of the request target URL (origin B), the page-origin cookies (page_cookie=SESSION_TOKEN) are attached to the outgoing request to destination B.
5. Capture credentials: The attacker's server at destination B receives the Cookie header containing origin A's session cookies, enabling session hijacking or unauthorized access to origin A's services (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from a Node.js process to unexpected external hosts carrying Cookie headers containing session tokens or authentication cookies not belonging to the destination domain.
• Logs: Application or access logs showing fetch requests with credentials: "include" directed at cross-origin endpoints, particularly where the Cookie header value matches cookies set for the page origin rather than the target origin.
• Process: Unusual Node.js process behavior making authenticated requests to third-party or attacker-controlled domains in SSR or test environments where such cross-origin credentialed requests are not expected.

Upgrade Happy DOM to version 20.8.9 or later, which corrects the cookie URL lookup to use the request target URL instead of the page origin URL (Release v20.8.9, Fix PR). As an additional defense-in-depth measure, consider setting the SameSite=Strict or SameSite=Lax attribute on sensitive cookies to limit cross-site transmission. Applications that do not require cross-origin credentialed fetches should avoid using credentials: "include" in Happy DOM contexts until the patch is applied.

The vulnerability was reported by security researcher r74tech and acknowledged by the Happy DOM maintainer (capricorn86), who patched and released version 20.8.9 on the same day as the advisory (Release v20.8.9). The advisory was noted in automated CVE tracking feeds and Bluesky CVE notification accounts shortly after disclosure, with no significant broader media coverage or notable community controversy observed.