CVE-2026-118659

The @happy-dom/server-renderer package (prior to version 21.0.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) and can be used as an Open Proxy . The root cause is located in the #onIncomingRequest function within packages/@happy-dom/server-renderer/src/ServerRendererServer.ts, where the...

ROOT-APP-NPM-GHSA-G2V6-RQMX-R4W6 GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer - Patched by Root

Root has patched GHSA-g2v6-rqmx-r4w6 in the @vue/server-renderer package for Root:npm. Multiple fixed versions available...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: GHSA-G2V6-RQMX-R4W6...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883244...

GHSA-G2V6-RQMX-R4W6 @vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883244...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883248...

@cbjwwwcode/common (>=0.0.2, <=0.1.5), @pocketjs/framework (>=0.7.0, <=0.15.0) +7 more potentially affected by unknown CVE via @vue/server-renderer (>=3.6.0-rc.1, <=3.6.0-rc.5)

@vue/server-renderer NPM version =3.6.0-rc.1, =0.0.2, =0.7.0, =0.0.5, =0.5.20, =1.4.33, =1.4.33, =3.6.0-rc.1, =3.6.0-rc.1, =3.6.0-rc.5 Source cves: unknown CVE Source advisory: SNYK:JS-VUESERVERRENDERER-20883248...

60p82u21t54k (>=0.1.2, <=0.1.8), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.35) +2895 more potentially affected by unknown CVE via @vue/server-renderer (>=3.0.0-rc.4, <=3.5.41)

@vue/server-renderer NPM version =3.0.0-rc.4, =0.1.2, =0.0.1-alpha.14, =0.1.6-alpha.11, =0.0.1-alpha.19, =4.0.61, =0.0.1, =1.15.1-sim3, =0.2.2, =3.0.0, =0.1.0, =1.3.1, =0.0.12, =1.0.28 and more Source cves: unknown CVE Source advisory: GHSA-G2V6-RQMX-R4W6...

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

PT-2026-115372

Description @vue/server-renderer was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser session that's already...

@happy-dom/global-registrator (>=19.0.0, <=19.0.2), @happy-dom/jest-environment (>=19.0.0, <=19.0.2) +4 more potentially affected by CVE-2025-62410 via happy-dom (>=19.0.2, <=20.0.0)

happy-dom NPM version =19.0.2, =19.0.0, =19.0.0, =19.0.0, =1.0.0, =0.1.9, =1.1.81, =1.1.82 Source cves: CVE-2025-62410 Source advisory: OSV:GHSA-QPM2-6CQ5-7PQ5...

Arbitrary Code Injection

Overview @happy-dom/server-renderer is an Use Happy DOM for server-side rendering SSR or as a static site generator SSG. Affected versions of this package are vulnerable to Arbitrary Code Injection due to default evaluation of code from strings. An attacker can execute arbitrary code on the host...

0xrtest (1.0.0), 8-divine (1.4.0) +1445 more potentially affected by CVE-2024-9506 via vue-server-renderer (>=2.7.4, <=2.7.16)

vue-server-renderer NPM version =2.7.4, =0.0.1, =1.1.61, =0.0.11, =0.9.29, =1.1.11, =1.0.1, =0.1.10, =0.0.3-dev, =0.0.1, =0.14.0, =0.14.1 - @alu0101353647/constant-folding 1.10.1 and more Source cves: CVE-2024-9506 Source advisory: MEND:CVE-2024-9506...

@alterjs/saber (>=0.12.0, <=0.13.0), @ambition.cn/abs-vue2-ui (>=0.0.4, <=0.0.19) +117 more potentially affected by CVE-2024-9506 via vue-server-renderer (>=2.6.1, <=2.6.14)

vue-server-renderer NPM version =2.6.1, =0.12.0, =0.0.4, =2.0.0-0, =2.1.0, =1.0.22, =2.0.0-0, =2.1.16, =1.6.24, =0.1.1, =1.1.1-alpha.0, =1.0.0, =0.0.72-alpha.0, =0.0.72-alpha.0, =2.1.0-beta, =2.1.4-alpha.0, =2.1.9 and more Source cves: CVE-2024-9506 Source advisory: MEND:CVE-2024-9506...

Vulnerable javascript dependency used in adminsidepanel.js

Description The adminsidepanel.js used Vue.js v2.6.10, which contains the vulnerable vue-server-renderer's dependency of serialize-javascript. Proof of Concept 1.Go to https://demo.limesurvey.org/tmp/assets/cb9c5d96/build.min/js/adminsidepanel.js and search for Vue.js v2.6.10 term. We can note th...