Happy-Dom (<= 20.14.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/happy-dom--20.14.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 06:12:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHappy DOM: Server-side request forgery via default HTML parsing (CVE-2026-118660)https://feed.craftedsignal.io/briefs/2026-10-happy-dom-ssrf/Thu, 29 Oct 2026 06:12:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-happy-dom-ssrf/Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.Happy DOM versions through 20.14.6 perform real server-side HTTP requests when parsing HTML content containing <iframe> or <link rel="stylesheet"> elements. This occurs because the default configurations disableIframePageLoading and disableCSSFileLoading are both set to false. When an application uses this library to parse untrusted user-provided HTML, an attacker can trigger unauthorized HTTP requests to internal resources or cloud metadata services.

Impact

Successful exploitation allows attackers to perform internal network reconnaissance, probe private services, or exfiltrate cloud metadata (such as IAM credentials from 169.254.169.254).

Recommendation

  • Update any application code using Happy DOM to explicitly disable external resource loading in the configuration settings.
  • Set disableIframePageLoading: true and disableCSSFileLoading: true in your Window initialization code.
  • Implement server-side URL validation to deny requests to RFC1918 private IP ranges and cloud metadata service endpoints (e.g., 169.254.169.254).
]]>highadvisoryssrflibrary-vulnerabilityweb-application-security