Fabric.js Vulnerability Allows Sensitive Information Disclosure via SSRF

A server-side request forgery (SSRF) vulnerability has been identified in the widely-used JavaScript library Fabric.js, tracked as CVE-2026-19504. This flaw allows remote attackers to potentially disclose sensitive information by tricking the library into making unintended requests to internal or external resources.

The vulnerability resides within the loadFromJSON method of the Fabric.js library. The core issue stems from a failure to adequately validate Uniform Resource Identifiers (URIs) before attempting to access the resources they point to. This lack of validation can be exploited by an attacker to craft malicious input that causes the library to fetch data from arbitrary network locations, thereby enabling information disclosure.

While the specific attack vectors can vary depending on how Fabric.js is implemented within a given application, the exploitation requires some form of interaction with the library. Attackers could potentially leverage this vulnerability to gain unauthorized access to network resources that are normally protected or inaccessible from the public internet. The potential impact ranges from revealing internal network structures to exfiltrating sensitive data.

The Zero Day Initiative (ZDI) has assigned this vulnerability a CVSS score of 4.0, classifying it as medium severity. This score reflects the potential for information disclosure but also considers that exploitation is not trivial and depends on the application's specific configuration and usage of the Fabric.js library.

Fabric.js has addressed this vulnerability by releasing an update. Developers are urged to update their installations to the latest version to mitigate the risk. The fix, detailed in a pull request on the project's GitHub repository, ensures proper validation of URIs within the loadFromJSON function, preventing the library from making unauthorized requests.

The disclosure timeline indicates that the vulnerability was first reported to the vendor on April 7, 2026. Following a coordinated disclosure process, the advisory was publicly released on August 24, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered by researcher nedlir.

This SSRF vulnerability highlights the ongoing challenges in securing complex JavaScript libraries that are integral to modern web applications. Developers must remain vigilant in validating all user-supplied input and ensuring that libraries are kept up-to-date with the latest security patches to prevent such vulnerabilities from being exploited.