CVE-2026-118659: @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@happy-dom/server-rendererto a version that resolves this vulnerability.Fixed in 21.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can send HTTP/2 requests to a vulnerable ServerRendererServer can exploit it. No privileges or user interaction are required.
What can an attacker reach through the vulnerable server?
An attacker can use a protocol-relative :path to redirect the server's fetch to arbitrary HTTP or HTTPS endpoints reachable from the server, including local and internal services. The server relays the fetched response headers and body back to the requester.
Are installations using version 21.0.2 affected?
No. The issue is fixed in version 21.0.2; versions prior to 21.0.2 are affected.