Patch Forecast
Amber warning
Patch this week.

CVE-2026-118660 · GHSA-c8p4-j97h-3vg8

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Risk score
67/100
CVSS
8.6 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A vulnerability in Happy DOM allows an attacker to cause server-side requests to arbitrary internal or cloud endpoints via untrusted HTML, potentially exposing confidential responses or credentials. This can occur when parsing untrusted HTML on the server, as the default behaviour loads iframe src URLs and link rel="stylesheet" href URLs by default.
Affected
{'products': ['Happy DOM'], 'packages': [{'ecosystem': 'npm', 'name': 'happy-dom', 'vulnerable': '<= 20.14.6', 'patched': '21.0.0'}]}
Fix
Upgrade to version 21.0.0 or later
Exploitation
Public proof of concept

Story map

Story map: happy-domTHE FLAWSTHE FIXCVE-2026-118660Happy DOM: SSRF via iframeand link stylesheet whenparsing untrusted HTMLCVSS 8.6CVE-2026-115895Happy DOM: Incomplete fix forCVE-2026-33943: unsanitizedimport alias leads to host…CVSS 8.8 · EPSS 0%CVE-2026-118661Happy DOM has cookie scopeforgery: no DNS-label boundaryon Domain= matching …CVSS 6.5Upgrade happy-dom21.0.0 · 21.0.4 · 20.14.6or later on your release lineWho is exposed{'products': ['Happy DOM'],'packages': ['happy-dom'],'versions': ['>= 17.0.0, <=21.0.3']}AMBER · PATCH THIS WEEKhappy-domA vulnerability in Happy DOMallows an attacker to executehost code by inserting anunsanitized import alias into agenerated destructuring binding.This could lead to code executionin the Node.js host process.Where it standsPublic proof of conceptCONNECTS TOSame weaknessServer-side request forgery (CWE-918)247 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

happy-dom: Amber, patch this week. A vulnerability in Happy DOM allows an attacker to execute host code by inserting an unsanitized import alias into a generated destructuring binding. This could lead to code execution in the Node.js host process.

The flaws

  • CVE-2026-118660: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML (CVSS 8.6)
  • CVE-2026-115895: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-118661: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVSS 6.5)

The fix

Upgrade happy-dom: 21.0.0 · 21.0.4 · 20.14.6 or later on your release line

Who is exposed: {'products': ['Happy DOM'], 'packages': ['happy-dom'], 'versions': ['>= 17.0.0, <= 21.0.3']}

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.6 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
happy-domnpm<= 20.14.621.0.0

References

Original description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.