CVE-2026-118660: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Happy DOMto a version that resolves this vulnerability.Fixed in 21.0.0 - Configuration
Set disableIframePageLoading and disableCSSFileLoading to true when parsing untrusted HTML to prevent loading iframe src and link rel="stylesheet" href URLs.
Happy DOM disableIframePageLoading and disableCSSFileLoading = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Happy DOM before 21.0.0 are exposed if they parse HTML that an attacker can control or influence on the server. The affected behavior can make requests to arbitrary internal or cloud endpoints reachable from that server.
Does this require an application to explicitly enable external resource loading?
No. Before 21.0.0, iframe page loading and CSS file loading are enabled by default because disableIframePageLoading and disableCSSFileLoading default to false.
What HTML content can trigger server-side requests?
An attacker-controlled iframe src URL or a link element with rel="stylesheet" and an href URL can trigger a request while the HTML is parsed.
What can be done if upgrading is not immediately possible?
Disable iframe page loading and CSS file loading by setting disableIframePageLoading and disableCSSFileLoading, and do not parse untrusted HTML with external resource loading enabled.
How can I determine whether my deployment is affected?
Check whether the application uses Happy DOM before version 21.0.0 and parses untrusted HTML. Also verify whether iframe and CSS file loading have been left enabled under their default settings.