Happy DOM’s fetch implementation incorrectly uses the page origin’s cookies instead of the target URL’s when the option credentials: "include" is set. This can result in cookies from origin A being sent to origin B, exposing sensitive session information. The weakness corresponds to information exposure weaknesses (CWE‑201, CWE‑359).

Happy DOM releases by Capricorn86 versions prior to 20.8.9 are affected. The implementation is a Node.js JavaScript environment used for server‑side rendering and automated browsing.

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw lies within client‑side JavaScript executing inside Happy DOM, an attacker would need to inject or run code that calls fetch(..., {credentials: "include"}) to a resource on a different origin; this inference is made from the description that the issue occurs when credentials: "include" is used, but the CVE does not detail the exact attack context. The risk to applications using Happy DOM for server‑side rendering or automated browsing is moderate, especially if the code processes untrusted input.