Skip to content

Upgrading happy-dom 20 to 21

Breaking20.14.6 → 21.0.4Breaking1Security6Deprecated1New2

Full comparisonBack to happy-dom
BreakingUpgrade verdict

1 breaking change and 6 security fixes.

In plain terms
  • By default, the library no longer fetches stylesheets or iframe pages, so untrusted HTML cannot make your server send requests to attacker-chosen URLs.
  • A security hole that could let attackers inject code through the module compiler is closed.
  • Iframes loaded from data: URLs can no longer reach into the page that embeds them.
  • Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Must act Top 5 of 8 that need code or config changes

What you must change

Breaking1
Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF).
21.0.0GitHub ReleaseSummarizedView source
Security6
Fixes a code injection vulnerability in the ESM compiler.
21.0.4GitHub ReleaseSummarizedView source
Fixes cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window.
21.0.4GitHub ReleaseSummarizedView source
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
High
21.0.4GitHub AdvisoryOriginalView source
Fixes a security vulnerability where the authorization header was forwarded when redirecting.
21.0.3GitHub ReleaseSummarizedView source
Fixes an SSRF security vulnerability by adding a target-origin bypass in the proxy server in @happy-dom/server-renderer.
@happy-dom/server-renderer
21.0.2GitHub ReleaseSummarizedView source
Explains that embedded iframe or stylesheet elements in untrusted HTML could make Happy DOM send HTTP requests to attacker-chosen URLs, including internal services.
<iframe><link rel="stylesheet">
21.0.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated1
Deprecates the settings property disableCSSFileLoading.
disableCSSFileLoading
21.0.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published .d.ts files. Not mixed with prose notes.

  • added: property IBrowserSettings.enableCSSFileLoading: boolean
  • added: property IBrowserSettings.enableIframePageLoading: boolean
  • added: property IOptionalBrowserSettings.enableCSSFileLoading?: boolean
  • added: property IOptionalBrowserSettings.enableIframePageLoading?: boolean
  • added: static method BrowserFrameURL.hasOpaqueOrigin(targetURL: URL): boolean
  • added: static method BrowserFrameURL.isSameOrigin(originURL: Pick<URL, 'origin'>, targetURL: URL): boolean
  • removed: property ICSSStyleDeclaration.'flow-tolerance': string
  • removed: property ICSSStyleDeclaration.flowTolerance: string
  • added: property ICSSStyleDeclaration.'border-block-end-radius': string
  • added: property ICSSStyleDeclaration.'border-block-start-radius': string
  • added: property ICSSStyleDeclaration.'border-bottom-radius': string
  • added: property ICSSStyleDeclaration.'border-inline-end-radius': string
  • added: property ICSSStyleDeclaration.'border-inline-start-radius': string
  • added: property ICSSStyleDeclaration.'border-left-radius': string
  • added: property ICSSStyleDeclaration.'border-right-radius': string
  • added: property ICSSStyleDeclaration.'border-top-radius': string
  • added: property ICSSStyleDeclaration.'fit-tolerance': string
  • added: property ICSSStyleDeclaration.borderBlockEndRadius: string
  • added: property ICSSStyleDeclaration.borderBlockStartRadius: string
  • added: property ICSSStyleDeclaration.borderBottomRadius: string
  • added: property ICSSStyleDeclaration.borderInlineEndRadius: string
  • added: property ICSSStyleDeclaration.borderInlineStartRadius: string
  • added: property ICSSStyleDeclaration.borderLeftRadius: string
  • added: property ICSSStyleDeclaration.borderRightRadius: string
  • added: property ICSSStyleDeclaration.borderTopRadius: string
  • added: property ICSSStyleDeclaration.fitTolerance: string