Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
影響: npm:happy-dom <= 20.14.6 → 21.0.0
happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| CVE | CVE-2026-118660 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:06、GitHub Advisory Databaseが「Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-118660。