CVE-2025-61927: Happy DOM: VM Context Escape can lead to Remote Code Execution

Should you act?

Normal patch cycle

No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.6%, percentile 50: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 50% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Needs an account (high (admin)). Exposure depends on who can log in.
• Only applies if your dependency tree includes happy-dom (npm) < 20.0.0, fixed in 20.0.0. Check your lockfile, including transitive dependencies.

What it is

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.

From the GitHub advisory

Escape of VM Context gives access to process level functionality

Summary Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Weakness type: CWE-94.

Product: happy-dom (npm) · Assigned by: GitHub_M · Published: 2025-10-10

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: high (admin)
• User interaction: active

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.64% probability of exploitation activity in the next 30 days; percentile 50.

Timeline

• 2025-10-10 — CVE record last updated
• 2025-10-10 — CVE record published by GitHub_M
• 2025-10-10 — GitHub-reviewed advisory GHSA-37j7-fg3j-429f published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-37j7-fg3j-429f github.com
2. CVE.org record CVE-2025-61927 cve.org
3. NVD entry CVE-2025-61927 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical npm advisories · Today’s Security Digest