Happy DOM is a JavaScript-based headless browser implementation. Versions before 20.8.9 incorrectly attach cookies from the current page origin (window.location) rather than the request target URL when fetch is called with credentials set to "include." This results in sensitive cookie data being sent to unintended destinations, violating the same-origin policy and potentially exposing sensitive information. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-359 (Exposure of Private Information Through Query Strings in GET Request). The issue is resolved in version 20.8.9.

An attacker or malicious endpoint could receive cookies belonging to a different origin, potentially exposing sensitive session or authentication tokens. This can lead to unauthorized access or session hijacking if the leaked cookies contain sensitive authentication data. The vulnerability does not affect integrity or availability but has a high confidentiality impact as indicated by the CVSS vector.

Users of happy-dom should upgrade to version 20.8.9 or later, where this issue is fixed. No other mitigation is indicated or required as the vendor has provided an official fix. Patch status is confirmed by the version update note in the advisory.