Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
capricorn86/happy-dom
master @ a4c4faf
6
Fixes
0
CVEs
CRITICAL
Peak severity
16.7%
Coverage
Highlights
Information Disclosure: 3 prior fixes. Scrutinize any change in this area.
packages/happy-dom/src/fetch/utilities/SyncFetchScriptBuilder.ts: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: The SyncFetchScriptBuilder component constructs scripts dynamically for synchronous fetch operations. Insecure string concatenation and improper serialization of target URLs allowed attackers to inject malicious JavaScript and achieve arbitrary code execution.
Information Disclosure: Faulty cross-origin cookie filtering logic during fetch operations allowed origin-specific cookies to be forwarded to unauthorized cross-origin destinations.
CORS Misconfiguration: Sensitive request headers, such as cookies and authorization payloads, were not properly stripped from outgoing requests during cross-origin redirects, violating standard fetch credentials specifications.