@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…py-dom/security/advisories/GHSA-pmf4-3xr3-xjhg Diğer
• github.com/capricorn86/happy-dom/pull/2520 Diğer
• github.com/…ommit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d Diğer
• github.com/capricorn86/happy-dom/releases/tag/v21.0.2 Diğer

Kayıt geçmişi

1. 28 Eki 2026 23:20Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
• 8,6 CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
• 8,8 CVE-2026-115895Happy DOM'da içe aktarma takma adı doğrulanmadığı için Node.js ana süreçte kod çalıştırma
• 7,7 CVE-2026-13451Kserve: kserve: server-side request forgery via malicious storageuri
• 4,7 CVE-2026-61529Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
• 8,3 CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources