Skip to content
Threat Feed
Subscribe
high advisory

Happy DOM: Server-side request forgery via default HTML parsing (CVE-2026-118660)

Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.

CVE search metadata

CVE search record: CVE-2026-118660. Severity: high. CVSS: 8.6. KEV: no. Product: happy-dom (<= 20.14.6). Brief: Happy DOM: Server-side request forgery via default HTML parsing (CVE-2026-118660). Brief link: https://feed.craftedsignal.io/briefs/2026-10-happy-dom-ssrf/

Triage facts

Revision 1
Applicability
happy-dom (<= 20.14.6)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 29, 06:12 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

Happy DOM versions through 20.14.6 perform real server-side HTTP requests when parsing HTML content containing <iframe> or <link rel="stylesheet"> elements. This occurs because the default configurations disableIframePageLoading and disableCSSFileLoading are both set to false. When an application uses this library to parse untrusted user-provided HTML, an attacker can trigger unauthorized HTTP requests to internal resources or cloud metadata services.

Impact

Successful exploitation allows attackers to perform internal network reconnaissance, probe private services, or exfiltrate cloud metadata (such as IAM credentials from 169.254.169.254).

Recommendation

  • Update any application code using Happy DOM to explicitly disable external resource loading in the configuration settings.
  • Set disableIframePageLoading: true and disableCSSFileLoading: true in your Window initialization code.
  • Implement server-side URL validation to deny requests to RFC1918 private IP ranges and cloud metadata service endpoints (e.g., 169.254.169.254).

Immediate actions

Review all instances of Happy DOM implementation in server-side code to determine if untrusted HTML is processed.

Development 48h

Threat Hunt

Search application logs for outbound HTTP GET requests originating from backend servers to cloud metadata endpoints (e.g., 169.254.169.254) or unexpected internal IP ranges.

T1046 high high confidence hunt now

Data: Network flow logs or egress proxy logs

Mitigations

Modify Happy DOM window configuration to set disableIframePageLoading to true and disableCSSFileLoading to true.

immediate Development

CVE-2026-118660