{"id":"ghsa-ghsa-c8p4-j97h-3vg8","seq":2056958,"kind":"advisory","title":"Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML","url":"https://github.com/advisories/GHSA-c8p4-j97h-3vg8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-c8p4-j97h-3vg8","summary":"影響: npm:happy-dom <= 20.14.6 → 21.0.0\nhappy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-118660"],"tags":["GHSA-c8p4-j97h-3vg8","happy-dom"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:06:42.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}