Back to the CVE list

CVE-2026-118659

@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

CVSS score

7.5

EPSS probability

—

Risk score

0.8

Published

2 h ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.6

CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Vendorcapricorn86 Producthappy dom+2 etkilenen

Patch status unknown2 h ago

6.5

CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Vendorcapricorn86 Producthappy dom+2 etkilenen

Patch status unknown2 h ago

9.8

CVE-2026-33943Code injection in Capricorn86 Happy Dom

Vendorcapricorn86 Producthappy dom

Patch verified Public Exploits:1EPSS %17 mo ago

7.5

CVE-2026-34226Information exposure in Capricorn86 Happy Dom

Vendorcapricorn86 Producthappy dom

Patch verified Public Exploits:1EPSS %07 mo ago

8.8

CVE-2026-115895Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Vendorcapricorn86 Producthappy dom+2 etkilenen

Patch status unknownEPSS %05 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-118659"