CVE-2026-118659

Description

A flaw was found in the Happy DOM server-renderer. The server accepts unauthenticated requests and fails to verify that the destination address remains trusted before making outbound requests. A remote attacker can exploit this issue by submitting a protocol-relative path, forcing the server to send requests to arbitrary network destinations, including internal services. Because the server forwards the resulting response back to the requester, this Server-Side Request Forgery (SSRF) flaw can lead to sensitive information disclosure.

Statement

Red Hat has evaluated this vulnerability as having a Moderate severity impact because, although it can be triggered remotely without authentication, the flaw is restricted to unintended request relaying and information disclosure rather than arbitrary code execution or host compromise. Within standard Red Hat environments, this component is intended for headless testing and client-side simulation rather than functioning as an internet-facing rendering daemon. Systems that do not bind the server-renderer service to untrusted network interfaces or that do not expose its HTTP/2 endpoint directly to external users are not vulnerable to remote exploitation.

Understanding the Weakness (CWE)

CWE-918

Confidentiality

Technical Impact: Read Application Data

Integrity

Technical Impact: Execute Unauthorized Code or Commands

Access Control

Technical Impact: Bypass Protection Mechanism

By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.