Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 21.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Happy DOM, a JavaScript library that simulates a web browser on the server, is affected before version 21.0.0 when it parses untrusted HTML. By default it fetches iframe and stylesheet URLs, which lets an attacker make the server send requests to internal or cloud endpoints and potentially expose sensitive responses or credentials.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- capricorn86 happy-dom
fixed in 21.0.0
- happy-domnpm
fixed in 21.0.0