# CVE-2026-118660: Happy DOM server-side request forgery via iframe and CSS loading

Source: https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118660 · Severity: high · CVSS 8.6 · Published 2026-10-28

Happy DOM is a JavaScript browser implementation used in server-side environments to parse and render HTML. Prior to version 21.0.0, Happy DOM automatically loads external resources referenced in iframes and stylesheets while parsing untrusted HTML without requiring explicit opt-in. An attacker controlling HTML input can exploit this to make unauthorized requests from the server to internal systems or cloud services, potentially exposing sensitive data or credentials.

Technologies: [Capricorn86 Happy DOM](https://junglewise.ai/threats/technologies/capricorn86-happy-dom), [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [Capricorn86](https://junglewise.ai/threats/vendors/capricorn86), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118660 being exploited in the wild.

**How severe is CVE-2026-118660?** High severity, with a CVSS score of 8.6, published 28 October 2026.

**Which products and versions are affected?** Capricorn86 Happy DOM before 21.0.0; happy-dom (npm) <= 20.14.6, SEMVER:introduced=0,fixed=21.0.0.

**Is there a fix for CVE-2026-118660?** Yes. happy-dom (npm): upgrade to 21.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118660 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118660?** Check whether you run Capricorn86 Happy DOM or happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 21.0.0 or later

  ```sh
  npm install happy-dom@21.0.0
  ```


## Technical details

Happy DOM contains an SSRF vulnerability in its default handling of iframe src URLs and link rel="stylesheet" href URLs during untrusted HTML parsing. The options disableIframePageLoading and disableCSSFileLoading defaulted to false, enabling automatic resource fetching. An attacker who controls parsed HTML can trigger server-side HTTP requests to arbitrary endpoints, potentially leaking confidential responses. The fix in version 21.0.0 inverts these defaults to disabled (enabled via enableIframePageLoading and enableCSSFileLoading flags).

## Affected products

- capricorn86 Happy DOM before 21.0.0

## Identifiers

- CVE-2026-118660
- GHSA-c8p4-j97h-3vg8

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74](https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74)
- [https://github.com/capricorn86/happy-dom/pull/2502](https://github.com/capricorn86/happy-dom/pull/2502)

## Related threats

- [Happy DOM cookie scope forgery in CookieContainer](https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM cookie leakage in fetch requests](https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests)
- [capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler](https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler)
- [happy-dom prototype pollution allowing arbitrary code execution](https://junglewise.ai/threats/cve-2025-62410-happy-dom-prototype-pollution-allowing-arbitrary-code-execution)