CVE-2025-61927 (CVSS 9.4): Critical RCE Flaw Discovered in Happy DOM, Over 2.7 Million Weekly Downloads Impacted

CVE-2025-61927 (CVSS 9.4) is a critical RCE flaw discovered in Happy DOM, a JavaScript library used to emulate web browsers for testing, scraping and SSR. The advisory notes that Happy DOM v19 and lower contain a vulnerability that could put the owner system at risk of remote code execution, by allowing untrusted scripts to escape the Node.js VM context and access process-level functionality. The library is reportedly used in environments with over 2.7 million weekly downloads.

The issue stems from how JavaScript execution is handled within the Node.js VM context, enabling attackers to exploit either CommonJS or ESM modules to gain control, and Happy DOM maintainers have released version 20 to mitigate the risk. To mitigate now, update to v20 or later, run Node.js with the flag --disallow-code-generation-from-strings if evaluation remains enabled, and disable JavaScript evaluation entirely when handling untrusted content.