138 matches found
CVE-2026-118660
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...
CVE-2026-118661
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...
CVE-2026-118659
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...
GHSA-C8P4-J97H-3VG8 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...
npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.6...
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...
GHSA-5FPQ-26GF-QWCR Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...
npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.5...
EUVD-2026-112468
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...
CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...
CVE-2026-118661
Happy DOM, a JavaScript-based web browser implementation, is vulnerable to cookie scope forgery in versions prior to 20.14.6 . The root cause is located in src/cookie/CookieContainer.ts, where the cookieMatchesURL function fails to enforce a DNS-label boundary when matching Domain attributes. Thi...
CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...
EUVD-2026-112467
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...
CVE-2026-118660
Prior to version 21.0.0 , the Happy DOM JavaScript library is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the library defaults disableIframePageLoading and disableCSSFileLoading to false, causing it to automatically load iframe src and link rel="stylesheet" URLs when...
CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...
CVE-2026-118659
The @happy-dom/server-renderer package (prior to version 21.0.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) and can be used as an Open Proxy . The root cause is located in the #onIncomingRequest function within packages/@happy-dom/server-renderer/src/ServerRendererServer.ts, where the...
PT-2026-129180
Name of the Vulnerable Software and Affected Versions happy-dom versions prior to 21.0.0 Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. When parsing untrusted HTML on the server, the software loads iframe src URLs and link...