happy-dom

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML.

Latest 21.0.1

NPM

80%

Total Score

healthy

Frequent releases and active contributions support this release, despite several GitHub Actions hygiene issues.

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the concentrated maintainer profile deserves attention; current release and commit activity provide meaningful compensation.

Repo issue activity

There were 47 new issues and 28 new pull requests in one month, with only 1 issue and 3 pull requests closed or merged; the backlog pattern is a mild maintenance concern.

Repo tooling

The repository uses Turbo and TypeScript build tooling, but no security scanning tools were detected; the existing security policy and workflow audit partly compensate for that gap.

Workflow audit

All three workflows were analyzed with no untrusted checkouts or script-injection findings, but all 14 action uses are unpinned and the audit found high-confidence template-injection, archived-action, and ad hoc package-installation issues. One workflow also has top-level write permissions, so the automation needs cleanup.

Vulnerabilities

Title	Versions	Severity
CVE-2026-34226 happy-dom is vulnerable to Insertion of Sensitive Information Into Sent Data in versions 0.0.0 - 20.8.9.	0.0.0 - 20.8.9	High
CVE-2026-33943 happy-dom is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 15.10.0 - 20.8.7.	15.10.0 - 20.8.7	High
CVE-2025-62410 happy-dom is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 19.0.0 - 20.0.2.	19.0.0 - 20.0.2	Critical
CVE-2025-61927 happy-dom is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 20.0.0.	0.0.0 - 20.0.0	Critical
AIKIDO-2024-10426 happy-dom is vulnerable to Remote Code Execution (RCE) in versions 13.0.0 - 15.10.1.	13.0.0 - 15.10.1	Critical

Package versions

Maintainers

davidortner

Direct Dependencies

Dependency	Last Release	Score
ws Version ^8.21.0	—	—
entities Version ^7.0.1	—	—
@types/ws Version ^8.18.1	—	—
@types/node Version >=20.0.0	—	—
whatwg-mimetype Version ^3.0.0	—	—