Happy DOM: Server-side request forgery via iframe and stylesheet loading
Summary
Happy DOM, a JavaScript DOM implementation for server-side use, loads iframe and link stylesheet URLs by default when it parses HTML. An attacker who can influence the parsed HTML can make the server send requests to internal or cloud endpoints and may receive confidential responses or credentials. No application opt-in is needed for this behaviour.
Affected
- capricorn86 Happy DOM (npm package happy-dom) before 21.0.0
- Lower bound of the affected range: Unknown.
Fixed in
- Fixed in version 21.0.0, which disables iframe page loading and CSS file loading by default.
- Recommended target: 21.0.4 or later, which also fixes the related CVE-2026-115895.
Workaround
- If you cannot upgrade immediately, set disableIframePageLoading and disableCSSFileLoading to true in the Happy DOM settings (documented for the 20.x line; verify for your version).
- Stop parsing untrusted HTML on the server with Happy DOM until the upgrade is done.
- Restrict outbound traffic from the application host, for example block internal and metadata addresses.
Exploitation
- No exploitation in the wild known; not listed in CISA KEV according to one project's tracking.
- The GitHub advisory includes a short reproduction snippet for the iframe and stylesheet cases. No public exploit module found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- EPSS: 0.4 %.
Our recommendation
- Check whether Happy DOM is in your production dependencies and whether it parses HTML that users or third parties can influence (rich text, email templates, link previews, prerendering).
- Upgrade to 21.0.4 or later and test your suites, as the settings changed and some tests may break.
- Until then, apply the workaround and restrict outbound requests from the application host.
- Monitor outbound connections from the application host for requests to internal or metadata addresses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Happy DOM commit 0a99c75 (disable CSS and iframe loading by default) github.com
- Happy DOM pull request #2502 github.com
- Happy DOM release v21.0.0 github.com
- GitHub Security Advisory GHSA-c8p4-j97h-3vg8 github.com
- GitLab Advisory Database entry CVE-2026-118660 advisories.gitlab.com
- OSV entry GHSA-c8p4-j97h-3vg8 osv.dev
- VulDB entry CVE-2026-118660 vuldb.com
- Happy DOM settings wiki github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:53.
Original description (NVD)
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.