CVE-2026-118660

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR18h
🚨High - Happy DOM Server-Side Request Forgery via Default External Resource Loading (CVE-2026-118660) Happy DOM enables external loading by default and will perform real network fetches for <iframe src> and <link rel="stylesheet" href> while parsing untrusted HTML server-side. Attacker-controlled HTML can trigger SSRF to internal/cloud metadata endpoints, potentially leaking sensitive responses/credentials. 👉Affected: happy-dom < 21.0.0 | Upgrade to 21.0.0
0000033
372 followersView on X

Explore more

Back to dashboard