CVE-2026-118659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118659", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T20:20:29.561Z", "dateUpdated": "2026-10-29T18:27:45.701Z"}, "containers": {"cna": {"title": "@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"}, {"name": "https://github.com/capricorn86/happy-dom/pull/2520", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/pull/2520"}, {"name": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d"}, {"name": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2"}], "affected": [{"vendor": "capricorn86", "product": "happy-dom", "versions": [{"version": "< 21.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:20:29.561Z"}, "descriptions": [{"lang": "en", "value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2."}], "source": {"advisory": "GHSA-pmf4-3xr3-xjhg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T18:27:17.941408Z", "id": "CVE-2026-118659", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:27:45.701Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118659", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T20:20:29.561Z", "dateUpdated": "2026-10-29T18:27:45.701Z"}, "containers": {"cna": {"title": "@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"}, {"name": "https://github.com/capricorn86/happy-dom/pull/2520", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/pull/2520"}, {"name": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d"}, {"name": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2"}], "affected": [{"vendor": "capricorn86", "product": "happy-dom", "versions": [{"version": "< 21.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:20:29.561Z"}, "descriptions": [{"lang": "en", "value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2."}], "source": {"advisory": "GHSA-pmf4-3xr3-xjhg", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118659", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T18:27:17.941408Z"}}}], "references": [{"url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:27:35.393Z"}}]}}

{"affected": [{"affectedData": [{"product": "happy-dom", "vendor": "capricorn86", "versions": [{"status": "affected", "version": "< 21.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2."}], "id": "CVE-2026-118659", "lastModified": "2026-10-29T19:17:18.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118659", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T18:27:17.941408Z", "version": "2.0.3"}}]}, "published": "2026-10-28T21:16:55.967", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d"}, {"source": "security-advisories@github.com", "url": "https://github.com/capricorn86/happy-dom/pull/2520"}, {"source": "security-advisories@github.com", "url": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "server-renderer: Happy DOM: Information disclosure via Server-Side Request Forgery", "id": "2563186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563186"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.", "A flaw was found in the Happy DOM server-renderer. The server accepts unauthenticated requests and fails to verify that the destination address remains trusted before making outbound requests. A remote attacker can exploit this issue by submitting a protocol-relative path, forcing the server to send requests to arbitrary network destinations, including internal services. Because the server forwards the resulting response back to the requester, this Server-Side Request Forgery (SSRF) flaw can lead to sensitive information disclosure."], "name": "CVE-2026-118659", "public_date": "2026-10-28T20:20:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118659\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118659\nhttps://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d\nhttps://github.com/capricorn86/happy-dom/pull/2520\nhttps://github.com/capricorn86/happy-dom/releases/tag/v21.0.2\nhttps://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate severity impact because, although it can be triggered remotely without authentication, the flaw is restricted to unintended request relaying and information disclosure rather than arbitrary code execution or host compromise. Within standard Red Hat environments, this component is intended for headless testing and client-side simulation rather than functioning as an internet-facing rendering daemon. Systems that do not bind the server-renderer service to untrusted network interfaces or that do not expose its HTTP/2 endpoint directly to external users are not vulnerable to remote exploitation.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,21.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "happy-dom", "source": "cna", "vendor": "capricorn86"}, "product": "happy-dom", "vendor": "capricorn86"}], "created": "2026-10-28T21:44:31.433449+00:00", "updated": "2026-10-28T22:00:18.014822+00:00", "vendors": ["capricorn86", "capricorn86$PRODUCT$happy-dom"]}