Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118660— Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Quick assessment

Affected

capricorn86 happy-dom

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Happy DOM 是一个不包含图形用户界面的 Web 浏览器 JavaScript 实现。在 21.0.0 版本之前，Happy DOM 在服务器端解析不可信 HTML 时，默认会加载 iframe 的 src 属性 URL 以及 link 标签中 rel="stylesheet" 的 href 属性 URL，这是因为和的默认值均为 false。因此，能够控制待解析 HTML 的攻击者可在未经应用程序明确启用的情况下，诱导服务器向任意内部或云环境端点发起请求，并可能获取这些端点返回的机密响应或凭据。该问题已在

CVSS 8.6 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1071 · Application Layer Protocol T1048 · Exfiltration Over Alternative Protocol T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Source: CVE Program / CVE List V5

Vulnerability Description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
capricorn86	happy-dom	< 21.0.0	-

II. Public POCs for CVE-2026-118660

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118660

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118660 (2)

Vendor Advisories for CVE-2026-118660 (1)

🔗 SSRF via iframe and link stylesheet when parsing untrusted HTML · Advisory · capricorn86/happy-dom · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-118660 (1)

🔗 Release v21.0.0 · capricorn86/happy-dom · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118660

Same Patch Batch · capricorn86 · 2026-10-28 · 3 CVEs total

CVE-2026-118659	7.5 HIGH	@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
CVE-2026-118661	6.5 MEDIUM	Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker orig

IV. Related Vulnerabilities

Same product: happy-dom

Same vendor: capricorn86

Same weakness: CWE-918