High 7.5Published Oct 28, 2026

CVE-2026-118659@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Updated under an hour ago (Oct 30, 2026, 6:10 AM ET)

Does this affect you?

It affects capricorn86 happy-dom. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.39%, higher than 33% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for capricorn86 happy-dom Exploited in the last 30 days

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.39% (percentile 33)
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Oct 29, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

capricorn86 happy-dom capricorn86:happy_dom (from the name)	before 21.0.2	CNA record

References

References

https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg	x-refsource-confirm
https://github.com/capricorn86/happy-dom/pull/2520	x-refsource-misc
https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d	x-refsource-misc
https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.