Product
Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.