CVE-2026-118659

A flaw was found in the Happy DOM server-renderer. The server accepts unauthenticated requests and fails to verify that the destination address remains trusted before making outbound requests. A remote attacker can exploit this issue by submitting a protocol-relative path, forcing the server to...

CLSA-2026-1793700814 TuxCare security update for happy-dom (2 CVEs)

TuxCare rebuilt happy-dom to address 2 CVEs. Fixed in 20.12.0-tuxcare.2...

CVE-2026-118660

A flaw was found in happy-dom. By default, external resources such as inline frame iframe sources and stylesheets are automatically fetched when parsing HTML documents on the server. A remote attacker who supplies untrusted HTML can trigger Server-Side Request Forgery SSRF, forcing the applicatio...

CVE-2026-118661

A flaw was found in happy-dom. The cookie management component fails to properly validate and match domain attributes, allowing it to accept cookies for unrelated domains and match hostnames without enforcing domain boundaries. In server-side rendering environments, a remote attacker controlling ...

Server-side Request Forgery (SSRF)

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via automatic loading of external...

07-calito-router (>=0.0.2, <=0.0.4), @1agh/maude (>=0.45.2, <=1.10.0) +75 more potentially affected by CVE-2026-118661 via happy-dom (>=20.0.0, <=20.14.5)

happy-dom NPM version =20.0.0, =0.0.2, =0.45.2, =0.5.0, =0.2.0, =0.2.0, =0.2.0, =0.0.28, =0.31.0-next.1.g20b3b5c16, =0.0.6, =0.1.0, =3.0.0, =5.2.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 and more Source cves: CVE-2026-118661 Source advisory: SNYK:JS-HAPPYDOM-21826828...

Server-side Request Forgery (SSRF)

Overview @happy-dom/server-renderer is an Use Happy DOM for server-side rendering SSR or as a static site generator SSG. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the proxy request handler in ServerRendererServer.ts, where the constructed URL is not...

Reliance on Cookies without Validation and Integrity Checking

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via th...

CVE-2026-118661

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the...

CVE-2026-118660

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

GHSA-C8P4-J97H-3VG8 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

07-calito-router (>=0.0.2, <=0.0.4), @01.software/cli (>=0.3.0, <=0.10.3) +810 more potentially affected by CVE-2026-118660 via happy-dom (>=20.0.0, <=20.14.6)

happy-dom NPM version =20.0.0, =0.0.2, =0.3.0, =0.4.0, =0.45.2, =0.2.0, =0.2.0, =0.1.5, =0.1.0, =0.2.1 and more Source cves: CVE-2026-118660 Source advisory: GHSA-C8P4-J97H-3VG8...

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.6...

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

07-calito-router (>=0.0.2, <=0.0.4), @1agh/maude (>=0.45.2, <=1.10.0) +75 more potentially affected by CVE-2026-118661 via happy-dom (>=20.0.0, <=20.14.5)

happy-dom NPM version =20.0.0, =0.0.2, =0.45.2, =0.5.0, =0.2.0, =0.2.0, =0.2.0, =0.0.28, =0.31.0-next.1.g20b3b5c16, =0.0.6, =0.1.0, =3.0.0, =5.2.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 and more Source cves: CVE-2026-118661 Source advisory: OSV:GHSA-5FPQ-26GF-QWCR...

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

npm: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.5...

GHSA-5FPQ-26GF-QWCR Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Summary A cookie-scoping bug in happy-dom lets an attacker origin set cookies that a victim origin then receives, diverging from browser semantics. Details happy-dom matches Domain=example.com against notexample.com endsWith without a DNS-label boundary, diverging from browser semantics verified...

07-calito-router (>=0.0.2, <=0.0.4), @1agh/maude (>=0.45.2, <=1.10.0) +75 more potentially affected by CVE-2026-118661 via happy-dom (>=20.0.0, <=20.14.5)

happy-dom NPM version =20.0.0, =0.0.2, =0.45.2, =0.5.0, =0.2.0, =0.2.0, =0.2.0, =0.0.28, =0.31.0-next.1.g20b3b5c16, =0.0.6, =0.1.0, =3.0.0, =5.2.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 and more Source cves: CVE-2026-118661 Source advisory: GHSA-5FPQ-26GF-QWCR...