Live › vulnerability › CVE-2026-118659
Go to dashboardHappy DOM's server-renderer package accepts unauthenticated HTTP/2 requests and resolves protocol-relative paths against its target origin without checking the destination. An attacker can make the server fetch arbitrary HTTP or HTTPS endpoints, including local and internal services, and receive the response headers and body back.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:35 UTC. All times on this page are UTC.
Teams running Happy DOM's server-renderer package with ServerRendererServer exposed to requests they do not control are exposed, because the endpoint takes unauthenticated HTTP/2 requests and proxies the fetched response back. Projects using Happy DOM only as a test DOM or a client-side library without the server renderer are not affected by this flaw. Teams that keep the renderer on a private network with no untrusted access have much less exposure.
No product ranges from the sources yet.
@happy-dom/server-renderer with npm ls @happy-dom/server-renderer@happy-dom/server-renderer to 21.0.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118659")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.