CVE-2026-33943 is a code injection flaw in happy-dom, a JavaScript implementation of a browser without a graphical interface. NVD scores it 8.8. Crafted export declarations in ES module scripts can run code. Upgrade to 20.8.8. The affected range is 15.10.0 through 20.8.7.
What's affected
Versions 15.10.0 through 20.8.7 are affected, and 20.8.8 is patched. The issue is in ECMAScriptModuleCompiler, which interpolated content from export { } declarations into generated code as an executable expression. The quote filter did not strip backticks, so template literal content slipped through. The CVSS vector needs user interaction.
happy-dom is often a dev and test dependency, but also used for server side rendering and scraping, which handle outside content.
How to check if you're exposed
npm ls happy-dom
Check whether any code path loads ES module scripts from content you do not control.
What to do now
- Upgrade happy-dom to 20.8.8 or later.
- Do not process untrusted pages in the same process as secrets.
- Run scraping and rendering jobs in isolated containers.
- Check lockfiles in CI and in tooling images.
Why it matters
The record uses CWE-94 and CWE-917, code injection and expression language injection. Building code from strings, then running it, invites this. Parsing input into data structures avoids it. The record is not marked as exploited in the wild and is not in CISA KEV.
For a library used mostly in tests and rendering, the key question is what content it loads. A test suite that renders your own components carries little risk. A crawler or server side renderer that loads pages from the web carries more. Check the places in your repositories where happy-dom is used and note which of them handle outside content, then prioritize those for the upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a test only dependency safe to ignore?
Not if tests load untrusted content. Upgrade anyway, since the fix is a patch release.
Sources
Last reviewed: 19 October 2026.
