{"id":"CVE-2026-118660","title":"Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML","summary":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel=\"stylesheet\" href URLs by default while parsing untrusted HTML on the server be…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"capricorn86","product":"happy-dom","affected":["happy-dom < 21.0.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T15:43:35.972529Z"},"published":"2026-10-28","updated":"2026-10-29","sourceUpdated":"2026-10-29T17:23:32.163Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118660","references":[{"url":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8","label":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8"},{"url":"https://github.com/capricorn86/happy-dom/pull/2502","label":"https://github.com/capricorn86/happy-dom/pull/2502"},{"url":"https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74","label":"https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74"},{"url":"https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0","label":"https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0"},{"url":"https://github.com/advisories/GHSA-c8p4-j97h-3vg8"}],"tags":["cve.org","ghsa","npm"],"aliases":["GHSA-c8p4-j97h-3vg8"],"ecosystem":"npm","patched":["happy-dom 21.0.0"],"epss":0.00405,"epssPercentile":0.3474,"ingestedAt":"2026-10-28T21:18:49.943Z","slug":"CVE-2026-118660","body":"## Overview\n\nHappy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel=\"stylesheet\" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.\n\n## Affected\n\n- `happy-dom < 21.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-118660)\n\nAffected packages:\n\n- `happy-dom <= 20.14.6`\n\nPatched in:\n\n- `happy-dom 21.0.0`\n\nSource: https://github.com/advisories/GHSA-c8p4-j97h-3vg8","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}