Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

影響: npm:happy-dom <= 20.14.6 → 21.0.0

happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements. Affected Versions - happy-dom stylesheets fetch their href URL via real HTTP requests When untrusted HTML is parsed, these…

在 GitHub Advisory Database 阅读

2026/10/29 06:06，GitHub Advisory Database 发布了“Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-118660。