Happy DOM ServerRenderer CVE-2026-118659

Exploitation requires the operator to deploy the @happy-dom/server-renderer package in its reverse-proxy/SSR mode (ServerRendererServer with the required server.targetOrigin configured) and to have that HTTP/2 port reachable by the attacker. Against that configuration no further conditions apply: it is remote and unauthenticated (AV:N/PR:N/UI:N), there is no authentication guard on #onIncomingRequest, and the default behavior of the proxy is vulnerable - the attacker only needs to send a :path beginning with // (using --path-as-is and --http2-prior-knowledge to preserve the leading double slash). The limiting factor is purely deployment scope: the vulnerability is only exposed where this specific proxy component is run and network-reachable; it is not triggered by using happy-dom merely as a test/DOM library. Affected versions are <=21.0.1; 21.0.2 adds the origin check.

This is a genuine, actionable SSRF/open-proxy flaw rather than an inflated high-CVSS paper risk, but its real-world priority is bounded by how narrowly the affected component is deployed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) indicates remote, low-complexity, unauthenticated exploitation with high confidentiality impact and no integrity or availability impact, which is fully consistent with the source-code evidence: @happy-dom/server-renderer's ServerRendererServer resolves an attacker-controlled HTTP/2 :path against server.targetOrigin and fetches it with no post-resolution origin check, then relays the full response. The vuln.today decision label is this_week, signaling prompt but non-emergency remediation. No EPSS probability and no CISA KEV status are present in the supplied data, so there is no evidence of active exploitation; the exploitation signal here is PoC maturity, not in-the-wild use. A complete, working proof-of-concept (Dockerfile, curl invocation, and poc.py) is published directly in the GHSA advisory, which materially raises practical exploitability for anyone exposing the proxy. SSVC automatable/technical-impact fields were not supplied and cannot be asserted. Net: for operators actually running the server-renderer in proxy mode this is a real priority (internal/metadata endpoint exposure), but the aggregate population at risk is limited by the niche deployment of that specific component.

An unauthenticated attacker who can reach the ServerRendererServer HTTP/2 port sends a request whose :path begins with a protocol-relative '//host:port/path' (e.g. //127.0.0.1:18081/secret), causing new URL() to switch origins away from the configured targetOrigin. The proxy then fetches that arbitrary internal/localhost endpoint (such as a cloud metadata service or internal API) and relays the full response headers and body back, enabling exfiltration from services never meant to be externally reachable. A full working proof-of-concept exploit is published in the GHSA advisory, and the low attack complexity with no authentication (AC:L/PR:N) makes exploitation trivial once the port is reachable.