높음취약점 권고JavaScript / Node.js2026. 10. 29. 오전 06:06

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

影響: npm:happy-dom <= 20.14.6 → 21.0.0

happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…

GitHub Advisory Database에서 읽기

X에서 속보 받기악용·대형 유출·장애를 대응 방법과 함께.

팔로우 @vulnpulse_app

CVE	CVE-2026-118660
정보원	GitHub Advisory Database
수집 시각	2026. 10. 29. 오전 09:48
데이터	Markdown　JSON

2026. 10. 29. 오전 06:06, GitHub Advisory Database에서 "Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118660.