Endor Labs said happy-dom can be tricked into running an attacker's commands. Happy-dom is a headless browser, meaning one with no window, which Node.js developers use for crawling and server-side requests. The flaw is tracked as CVE-2025-61927 and is rated critical. Malicious page code can slip out of the package's weak isolation. The maintainer turned off JavaScript on loaded pages by default and advised a Node.js flag against building code from strings. Endor Labs said that advice was not enough. Attackers could still alter shared built-in objects, a trick called prototype pollution, to crash a program or run code. After Endor Labs reported this, the maintainer issued CVE-2025-62410 and advised a second flag, --frozen-intrinsics.
Endor Labs said the second flag stops those pollution attempts. It still thinks malicious code might read global values or use side channels. It urged the maintainer to move to a secure sandbox, but the maintainer declined because of the rewrite needed. The article does not say whether attackers have used these flaws in real attacks. It also does not list affected or fixed versions.
Teams that use happy-dom to crawl or render pages they do not control are running untrusted code. Endor Labs notes that Node.js says its vm module, which happy-dom relies on, is not a security tool. For now, its advice is to wrap happy-dom in a Docker container or virtual machine.