p PatchFirst

CVE-2024-51757

CVE-2024-51757 · Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

This page contains facts from public vulnerability sources. Check the original advisory before updating.

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability.

CVSS 9.3 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • happy-dom

    Versions
    • < 15.10.2: Affected

    No fix published

  • happy-dom npm

    Affected ranges
    • SEMVER: < 15.10.2

    Update to 15.10.2

Original sources

Check your server →