Read the docs
TI-2026-82200 Aliases CVE-2026-118659

Server-side request forgery in Happy DOM server renderer proxy

Priority HIGH 72CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The Happy DOM server-renderer package before 21.0.2 contains an open proxy flaw in its ServerRendererServer, which accepts unauthenticated HTTP/2 requests. The server resolves attacker-controlled :path values against server.targetOrigin without checking that the resolved origin stays trusted, which is a server-side request forgery (CWE-918). An unauthenticated remote attacker can send a protocol-relative path to make the server fetch an arbitrary HTTP or HTTPS endpoint, including local and internal services, and the proxy relays the response headers and body back to the requester.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed happy-dom (capricorn86): 21.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
capricorn86happy-dombefore 21.0.221.0.2Patch availableCNA
  • happy-dom Vendorcapricorn86 Affected before 21.0.2 Fixed in 21.0.2 Patch available CNA

Remediation

Upgrade @happy-dom/server-renderer, part of happy-dom by capricorn86, to version 21.0.2 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA happy-dom (capricorn86) Fixed in 21.0.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118659
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: MEDIUM → HIGH
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2024-34662 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag CVSS 4.0CRITICAL 9.3
  • TI-2026-26294 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVSS 3.1CRITICAL 9.8
  • TI-2025-38677 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom CVSS 4.0CRITICAL 9.4
  • TI-2026-80004 Code injection in Happy DOM import aliases allows host code execution CVSS 3.1HIGH 8.8
  • TI-2026-26521 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVSS 3.1HIGH 7.5
  • TI-2026-82202 Cookie scope forgery in Happy DOM lets attackers set victim cookies CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences