CVE-2026-118659

Name of the Vulnerable Software and Affected Versions Happy DOM versions prior to 21.0.2

Description The server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in the onIncomingRequest() function. Because the system does not confirm that the resolved origin remains trusted before calling fetch, a protocol-relative path can redirect the destination to any arbitrary HTTP or HTTPS endpoint reachable by the server, including internal and local services. The proxy then relays the fetched response headers and body back to the requester.

Recommendations Update to version 21.0.2.