A high-severity information disclosure vulnerability in the Happy DOM library, version 20.8.9 and earlier, permits the accidental leakage of sensitive cookies across different origins.

This issue is an improper control of sensitive information (CWE-201/CWE-359) occurring when the fetch function is utilized with credentials: "include". Unauthenticated attackers can trigger this logic flaw, which causes the library to incorrectly associate cookies with a request target URL instead of the current window location.

The leakage of sensitive cookies can lead to unauthorized session exposure or the compromise of private user data. Given the CVSS score of 7.5, this vulnerability represents a significant risk to application security, as it facilitates the potential hijacking of user sessions or the exfiltration of sensitive authentication tokens.

Immediate Action: Update the happy-dom package to version 20.8.9 or later immediately to resolve the cookie handling logic error.

Proactive Monitoring: Review application logs for suspicious outbound fetch requests or anomalous traffic patterns originating from front-end environments.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict where the application can send data, which may reduce the impact of unauthorized cookie transmission.

Public Exploit Available: Unknown.

This vulnerability poses a clear risk to data confidentiality by potentially exposing session cookies. Security teams must prioritize updating the happy-dom dependency to version 20.8.9 or higher across all affected environments to eliminate this exposure. Failure to patch will leave applications vulnerable to session-based attacks that could be triggered without user interaction.