## Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-118660
- 公開日時: 2026-10-28T21:06:42.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c8p4-j97h-3vg8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c8p4-j97h-3vg8

影響: npm:happy-dom <= 20.14.6 → 21.0.0
happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…