Server-side request forgery in Happy DOM HTML parser
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
Happy DOM before 21.0.0 is affected. When parsing untrusted HTML on the server, it fetches iframe src and stylesheet href URLs by default, because the disableIframePageLoading and disableCSSFileLoading options default to false (CWE-918). An attacker who controls the parsed HTML can make the server send requests to arbitrary internal or cloud endpoints without any application opt-in, and may read confidential responses or credentials returned by them.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| capricorn86 | happy-dom | before 21.0.0 | 21.0.0 | Patch available | CNA |
| — | happy-dom (npm) | before 21.0.0 | 21.0.0 | Patch available | GHSA-c8p4-j97h-3vg8 |
- happy-dom Vendorcapricorn86 Affected before 21.0.0 Fixed in 21.0.0 Patch available CNA
- happy-dom (npm) Vendor— Affected before 21.0.0 Fixed in 21.0.0 Patch available GHSA-c8p4-j97h-3vg8
Remediation
Upgrade the npm package happy-dom to version 21.0.0, which fixes the issue. The sources list no fixed version for Red Hat Ansible Automation Platform 2 and Red Hat OpenShift AI (RHOAI).
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA happy-dom (capricorn86) Fixed in 21.0.0
- Fix · GHSA-c8p4-j97h-3vg8 happy-dom (npm) Fixed in 21.0.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118660
- 2026-10-28 Alias added: GHSA-c8p4-j97h-3vg8
- 2026-10-28 Fix available: npm/[email protected] · GHSA-c8p4-j97h-3vg8
- 2026-10-28 CVSS score added · GHSA-c8p4-j97h-3vg8
- 2026-10-28 Weakness changed · GHSA-c8p4-j97h-3vg8
- 2026-10-28 5 new references · GHSA-c8p4-j97h-3vg8
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
References
Other 5
- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8
- https://github.com/capricorn86/happy-dom/pull/2502
- https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74
- https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0
- https://github.com/capricorn86/happy-dom
More capricorn86 vulnerabilities
- TI-2024-34662 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag CVSS 4.0CRITICAL 9.3
- TI-2026-26294 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVSS 3.1CRITICAL 9.8
- TI-2025-38677 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom CVSS 4.0CRITICAL 9.4
- TI-2026-80004 Code injection in Happy DOM import aliases allows host code execution CVSS 3.1HIGH 8.8
- TI-2026-82200 Server-side request forgery in Happy DOM server renderer proxy CVSS 3.1HIGH 7.5
- TI-2026-26521 Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVSS 3.1HIGH 7.5
Sources
- CVE-2026-118660 · CVE Program
- CVE-2026-118660 · NVD
- FIRST EPSS
- GHSA-c8p4-j97h-3vg8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118660 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences