High severity · published Oct 28, 2026
CVE-2026-118660
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
New
8.6
CVSS
–
EPSS
No
On KEV
Description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
happy-dom · capricorn86
< 21.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118660
github.com
https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74
github.com
https://github.com/capricorn86/happy-dom/pull/2502
github.com
https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0
github.com
https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8
More from happy-dom
9.8
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
9.4
CVE-2025-62410
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
8.8
CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
7.5
CVE-2026-118659
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
7.5
CVE-2026-34226
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies