VYPR
Get started
← All advisories
Critical severityOSV Advisory· Published Oct 15, 2025· Updated Apr 15, 2026

CVE-2025-62410

CVE-2025-62410

Description

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
happy-domnpm
>= 19.0.0, < 20.0.220.0.2

Affected products

1

Patches

1
f4bd4ebe3fe5

fix: [#0] Adds frozen intrinsics flag to server-renderer workers (#1934)

https://github.com/capricorn86/happy-domDavid OrtnerOct 15, 2025via ghsa
commit
2 files changed · +9 −3
  • packages/@happy-dom/server-renderer/src/ServerRenderer.ts+1 −1 modified
    @@ -197,7 +197,7 @@ export default class ServerRenderer {
 					return;
 				}
 				const worker = new Worker(new URL('ServerRendererWorker.js', import.meta.url), {
-					execArgv: ['--disallow-code-generation-from-strings'],
+					execArgv: ['--disallow-code-generation-from-strings', '--frozen-intrinsics'],
 					workerData: {
 						configuration: configuration
 					}
  • packages/@happy-dom/server-renderer/test/ServerRenderer.test.ts+8 −2 modified
    @@ -58,7 +58,10 @@ describe('ServerRenderer', () => {
 					'file://' + Path.resolve(Path.join('src', 'ServerRendererWorker.js'))
 				);
 
-				expect(worker.execArgv).toEqual(['--disallow-code-generation-from-strings']);
+				expect(worker.execArgv).toEqual([
+					'--disallow-code-generation-from-strings',
+					'--frozen-intrinsics'
+				]);
 
 				expect(worker.workerData.configuration.cache.directory).toBe(
 					Path.resolve(Path.join('happy-dom', 'cache'))
@@ -216,7 +219,10 @@ describe('ServerRenderer', () => {
 					'file://' + Path.resolve(Path.join('src', 'ServerRendererWorker.js'))
 				);
 
-				expect(worker.execArgv).toEqual(['--disallow-code-generation-from-strings']);
+				expect(worker.execArgv).toEqual([
+					'--disallow-code-generation-from-strings',
+					'--frozen-intrinsics'
+				]);
 
 				expect(worker.workerData.configuration.cache.directory).toBe(
 					Path.resolve(Path.join('happy-dom', 'cache'))

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.