CVE-2026-118660

Name of the Vulnerable Software and Affected Versions happy-dom versions prior to 21.0.0

Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. When parsing untrusted HTML on the server, the software loads iframe src URLs and link rel="stylesheet" href URLs by default. This occurs because the variables disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls the parsed HTML can trigger Server-Side Request Forgery (SSRF), causing the server to make requests to arbitrary internal or cloud endpoints. This may lead to the exposure of confidential responses, internal network scanning, or the theft of cloud credentials from metadata endpoints.

Recommendations Update to version 21.0.0. As a temporary workaround, set the disableIframePageLoading and disableCSSFileLoading variables to true to disable external resource loading.