PT-2026-146086

Summary The @astrojs/solid-js renderer wraps named slot content passed to Solid components in an element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page. For example, a page that take...

CVE-2026-118659

A flaw was found in the Happy DOM server-renderer. The server accepts unauthenticated requests and fails to verify that the destination address remains trusted before making outbound requests. A remote attacker can exploit this issue by submitting a protocol-relative path, forcing the server to...

Server-side Request Forgery (SSRF)

Overview @happy-dom/server-renderer is an Use Happy DOM for server-side rendering SSR or as a static site generator SSG. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the proxy request handler in ServerRendererServer.ts, where the constructed URL is not...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659

The @happy-dom/server-renderer package (prior to version 21.0.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) and can be used as an Open Proxy . The root cause is located in the #onIncomingRequest function within packages/@happy-dom/server-renderer/src/ServerRendererServer.ts, where the...

EUVD-2026-112466

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

PT-2026-129179

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

ROOT-APP-NPM-GHSA-G2V6-RQMX-R4W6 GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer - Patched by Root

Root has patched GHSA-g2v6-rqmx-r4w6 in the @vue/server-renderer package for Root:npm. Multiple fixed versions available...

PT-2026-132068

Root has patched GHSA-g2v6-rqmx-r4w6 in the @vue/server-renderer package for Root:npm. Multiple fixed versions available...

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2818 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883248...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2818 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.16.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2818 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883244...