Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

High 8.6

In plain English

A high-severity server-side request forgery in happy-dom from capricorn86. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 65.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	happy-dom	21.0.0	GHSA-c8p4-j97h-3vg8

Affected products (as reported)

Vendor	Product	Versions
capricorn86	happy-dom	< 21.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8 x_refsource_CONFIRM
https://github.com/capricorn86/happy-dom/pull/2502 x_refsource_MISC
https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74 x_refsource_MISC
https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0 x_refsource_MISC