{"id":"CVE-2026-118659","kind":"vulnerability","aliases":["CVE-2026-118659"],"related":[],"title":"Happy DOM: server renderer proxies unauthenticated requests to internal services","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.","summary":"Happy DOM's server-renderer package accepts unauthenticated HTTP/2 requests and resolves protocol-relative paths against its target origin without checking the destination. An attacker can make the server fetch arbitrary HTTP or HTTPS endpoints, including local and internal services, and receive the response headers and body back.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["happy-dom","node","package","self-hosted","server-side-rendering"],"not_affected_if":["client-only-use","no-server-renderer"],"how_to_check":"- Check the installed version of `@happy-dom/server-renderer` with `npm ls @happy-dom/server-renderer`\n- Confirm whether the ServerRendererServer is running and reachable from untrusted networks (unknown from sources)","fix":"- Upgrade `@happy-dom/server-renderer` to `21.0.2` or later\n- Restrict network access to the renderer server until upgraded (unknown from sources for other mitigations)","status":"open","published_at":"2026-10-28T21:16:55+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","triaged_at":"2026-10-28T21:36:36+00:00","updated_at":"2026-10-28T21:36:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T21:36:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@happy-dom/server-renderer` to `21.0.2` or later\n- Restrict network access to the renderer server until upgraded (unknown from sources for other mitigations)","reach":"internet","title":"Happy DOM: server renderer proxies unauthenticated requests to internal services","impact":"medium","summary":"Happy DOM's server-renderer package accepts unauthenticated HTTP/2 requests and resolves protocol-relative paths against its target origin without checking the destination. An attacker can make the server fetch arbitrary HTTP or HTTPS endpoints, including local and internal services, and receive the response headers and body back.","category":"package","nicknames":[],"who_cares":["happy-dom","node","self-hosted","server-side-rendering"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reaches internal services and reads their responses through the server","analyst_note":"Confirm the affected version range and whether the NVD entry lists a patch commit or advisory beyond the fixed version 21.0.2.","how_to_check":"- Check the installed version of `@happy-dom/server-renderer` with `npm ls @happy-dom/server-renderer`\n- Confirm whether the ServerRendererServer is running and reachable from untrusted networks (unknown from sources)","needs_analyst":true,"not_affected_if":["client-only-use","no-server-renderer"],"who_is_affected":"Teams running Happy DOM's server-renderer package with ServerRendererServer exposed to requests they do not control are exposed, because the endpoint takes unauthenticated HTTP/2 requests and proxies the fetched response back. Projects using Happy DOM only as a test DOM or a client-side library without the server renderer are not affected by this flaw. Teams that keep the renderer on a private network with no untrusted access have much less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3460,"output_tokens":671,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118659':13A,16A '-2026':12A,15A '/server-renderer/src/serverrendererserver.ts':126C '21.0.2':96C,182C 'accept':36B,106C 'arbitrari':61B,149C 'attack':55B,113C 'attacker-control':112C 'back':78B 'bodi':77B,172C 'browser':88C 'call':136C 'chang':144C 'check':51B 'confirm':128C 'control':114C 'cve':11A,14A 'destin':53B,146C 'dom':2A,19B,30B,80C,99C,125C 'endpoint':65B,153C 'fetch':60B,137C,168C 'fix':179C 'graphic':91C 'happi':1A,18B,29B,79C,98C,124C 'happy-dom':17B,123C 'header':75B,170C 'host':24B 'http':62B,150C 'http/2':38B,108C 'https':64B,152C 'implement':84C 'includ':66B,158C 'interfac':93C 'intern':9A,69B,161C 'issu':177C 'javascript':83C 'local':67B,159C 'make':57B 'node':20B 'onincomingrequest':120C 'origin':49B,132C 'packag':21B,35B,103C,122C 'path':45B,115C,142C 'prior':94C 'protocol':43B,140C 'protocol-rel':42B,139C 'proxi':5A,165C 'reachabl':154C 'receiv':72B 'relat':44B,141C 'relay':166C 'remain':133C 'render':4A,28B,34B,102C 'request':7A,39B,109C,175C 'resolv':41B,111C,131C 'respons':74B,169C 'self':23B 'self-host':22B 'server':3A,26B,33B,59B,101C,157C 'server-render':32B,100C 'server-side-rend':25B 'server.targetorigin':118C 'serverrendererserv':105C 'servic':10A,70B,162C 'side':27B 'target':48B 'trust':134C 'unauthent':6A,37B,107C 'user':92C 'valu':116C 'version':181C 'web':87C 'without':50B,89C,127C","nicknames":[],"mitigations":[],"who_affected":"Teams running Happy DOM's server-renderer package with ServerRendererServer exposed to requests they do not control are exposed, because the endpoint takes unauthenticated HTTP/2 requests and proxies the fetched response back. Projects using Happy DOM only as a test DOM or a client-side library without the server renderer are not affected by this flaw. Teams that keep the renderer on a private network with no untrusted access have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T21:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118659","severity":null,"published_at":"2026-10-28T21:16:55+00:00","modified_at":"2026-10-28T21:16:55+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}