Server-Side Request Forgery in Happy DOM JavaScript Framework

CVE-2026-118660

What is CVE-2026-118660?

Happy DOM is a JavaScript framework designed to simulate web browser capabilities without a graphical user interface. Earlier versions, specifically those before 21.0.0, are susceptible to a serious issue wherein untrusted HTML can lead to unauthorized server-side requests. The default settings of disableIframePageLoading and disableCSSFileLoading being set to false allow attackers to leverage their control over parsed HTML. As a result, they may initiate requests to internal or external endpoints on the server, risking exposure of sensitive data and credentials. This vulnerability was addressed and resolved in version 21.0.0, highlighting the importance of keeping software up-to-date.

References