Happy DOM Flaw Allows Remote Code Execution Affecting 2.7 Million Users

A critical security vulnerability has been discovered in Happy DOM, a JavaScript library used for server-side rendering and testing frameworks, tracked as CVE-2025-61927. According to Mas0nShi, attackers can escape the VM context by abusing the Function constructor chain to run code at the process level, with the flaw affecting Happy DOM versions 19 and below and exposing millions of applications worldwide.

The vulnerability allows data exfiltration, lateral movement, arbitrary command execution, and potential persistence, particularly in server-side rendering environments that process untrusted HTML content. The flaw’s maximum CVSS v4 score is 10.0, and it has prompted the Happy DOM maintainer Ortner IT Solutions AB to release version 20, which disables JavaScript evaluation by default and adds warnings for unsafe configurations.

Organisations using affected versions are urged to upgrade to Happy DOM v20 or later, or to disable JavaScript evaluation if upgrading is not immediately possible, and to apply the --disallow-code-generation-from-strings flag where necessary. The article notes the number of affected users as approximately 2.7 million. 13 October 2025.