CVE-2026-118659— @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Quick assessment

Affected

capricorn86 happy-dom

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Happy DOM 是一个没有图形用户界面的 JavaScript 实现的 Web 浏览器。在 21.0.2 版本之前，Happy DOM 的服务器端渲染包（server-renderer）中的组件会接受未经验证的 HTTP/2 请求，并在文件的方法中，将攻击者可控制的值相对于进行解析，但在调用之前并未验证解析后的源是否可信。利用协议相对路径（protocol-relative path），攻击者可以将请求目标更改为服务器可访问的任意 HTTP 或 HTTPS 端点，包括本地和内部服务；代理随后会将获取

CVSS 7.5 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1071.001 · Web Protocols T1043 T1059.007 · JavaScript

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Source: CVE Program / CVE List V5

Vulnerability Description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
capricorn86	happy-dom	< 21.0.2	-

II. Public POCs for CVE-2026-118659

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118659

请登录查看更多情报信息。

Other References for CVE-2026-118659 (4)

https://github.com/capricorn86/happy-dom/pull/2520 x_refsource_MISC
https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2 x_refsource_MISC
https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg x_refsource_CONFIRM
https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118659

Same Patch Batch · capricorn86 · 2026-10-28 · 3 CVEs total

CVE-2026-118660	8.6 HIGH	Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
CVE-2026-118661	6.5 MEDIUM	Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker orig

IV. Related Vulnerabilities

Same product: happy-dom

Same vendor: capricorn86

Same weakness: CWE-918