HighAdvisoryJavaScript / Node.js10/29/2026, 06:06 AM

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

影響: npm:happy-dom <= 20.14.6 → 21.0.0

happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…

Read on GitHub Advisory Database

Get these alerts on XExploits, big breaches and outages, with what to do.

Follow @vulnpulse_app

CVE	CVE-2026-118660
Source	GitHub Advisory Database
Fetched	10/29/2026, 09:48 AM
Data	Markdown　JSON

On 10/29/2026, 06:06 AM, GitHub Advisory Database published "Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-118660.