Bug 2563184 (CVE-2026-118660)
| Summary: | CVE-2026-118660 happy-dom: happy-dom: Server-Side Request Forgery via default loading of external resources | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | doconnor, dschmidt, jlanda, kshier, rbobbitt, simaishi, stcannon, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in happy-dom. By default, external resources such as inline frame (iframe) sources and stylesheets are automatically fetched when parsing HTML documents on the server. A remote attacker who supplies untrusted HTML can trigger Server-Side Request Forgery (SSRF), forcing the application to make unauthorized network requests to internal network services or cloud endpoints. This could lead to information disclosure, exposing confidential internal responses or credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2563397, 2563399, 2563400 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-28 20:32:42 UTC
|