Is CVE-2026-118660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118660 being exploited in the wild.

How severe is CVE-2026-118660?

High severity, with a CVSS score of 8.6, published 28 October 2026.

Which products and versions are affected?

Capricorn86 Happy DOM before 21.0.0; happy-dom (npm) <= 20.14.6, SEMVER:introduced=0,fixed=21.0.0.

Is there a fix for CVE-2026-118660?

Yes. happy-dom (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118660 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118660?

Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118660: Happy DOM server-side request forgery via iframe and CSS loading

Q: Is there a fix for CVE-2026-118660?

Yes. happy-dom (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118660 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118660?

Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118660 · Severity: high · CVSS 8.6 · Published 2026-10-28

Happy DOM is a JavaScript browser implementation used in server-side environments to parse and render HTML. Prior to version 21.0.0, Happy DOM automatically loads external resources referenced in iframes and stylesheets while parsing untrusted HTML without requiring explicit opt-in. An attacker controlling HTML input can exploit this to make unauthorized requests from the server to internal systems or cloud services, potentially exposing sensitive data or credentials.

Technologies: Capricorn86 Happy DOM, happy-dom (npm). Vendors: Capricorn86, npm.

Quick answers

Is CVE-2026-118660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118660 being exploited in the wild.
How severe is CVE-2026-118660?: High severity, with a CVSS score of 8.6, published 28 October 2026.
Which products and versions are affected?: Capricorn86 Happy DOM before 21.0.0; happy-dom (npm) <= 20.14.6, SEMVER:introduced=0,fixed=21.0.0.
Is there a fix for CVE-2026-118660?: Yes. happy-dom (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118660 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118660?: Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

happy-dom (npm): upgrade to 21.0.0 or later
```
npm install happy-dom@21.0.0
```

Technical details

Happy DOM contains an SSRF vulnerability in its default handling of iframe src URLs and link rel="stylesheet" href URLs during untrusted HTML parsing. The options disableIframePageLoading and disableCSSFileLoading defaulted to false, enabling automatic resource fetching. An attacker who controls parsed HTML can trigger server-side HTTP requests to arbitrary endpoints, potentially leaking confidential responses. The fix in version 21.0.0 inverts these defaults to disabled (enabled via enableIframePageLoading and enableCSSFileLoading flags).

Affected products

capricorn86 Happy DOM before 21.0.0

Identifiers

CVE-2026-118660
GHSA-c8p4-j97h-3vg8

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.