{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/happy-dom--20.14.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:happy-dom:happy-dom:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-118660"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["happy-dom (\u003c= 20.14.6)"],"_cs_severities":["high"],"_cs_tags":["ssrf","library-vulnerability","web-application-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eHappy DOM versions through 20.14.6 perform real server-side HTTP requests when parsing HTML content containing \u003ccode\u003e\u0026lt;iframe\u0026gt;\u003c/code\u003e or \u003ccode\u003e\u0026lt;link rel=\u0026quot;stylesheet\u0026quot;\u0026gt;\u003c/code\u003e elements. This occurs because the default configurations \u003ccode\u003edisableIframePageLoading\u003c/code\u003e and \u003ccode\u003edisableCSSFileLoading\u003c/code\u003e are both set to \u003ccode\u003efalse\u003c/code\u003e. When an application uses this library to parse untrusted user-provided HTML, an attacker can trigger unauthorized HTTP requests to internal resources or cloud metadata services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform internal network reconnaissance, probe private services, or exfiltrate cloud metadata (such as IAM credentials from \u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate any application code using Happy DOM to explicitly disable external resource loading in the configuration settings.\u003c/li\u003e\n\u003cli\u003eSet \u003ccode\u003edisableIframePageLoading: true\u003c/code\u003e and \u003ccode\u003edisableCSSFileLoading: true\u003c/code\u003e in your \u003ccode\u003eWindow\u003c/code\u003e initialization code.\u003c/li\u003e\n\u003cli\u003eImplement server-side URL validation to deny requests to RFC1918 private IP ranges and cloud metadata service endpoints (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T06:12:37Z","date_published":"2026-10-29T06:12:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-happy-dom-ssrf/","summary":"Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.","title":"Happy DOM: Server-side request forgery via default HTML parsing (CVE-2026-118660)","url":"https://feed.craftedsignal.io/briefs/2026-10-happy-dom-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Happy-Dom (\u003c= 20.14.6)","version":"https://jsonfeed.org/version/1.1"}