CVE-2026-19504 Overview
CVE-2026-19504 is a Server-Side Request Forgery (SSRF) vulnerability in the Fabric.js JavaScript library. The flaw resides in the loadFromJSON method, which fails to properly validate Uniform Resource Identifiers (URIs) before accessing referenced resources. Remote attackers can leverage this weakness to disclose sensitive information from network resources reachable by the vulnerable host. Exploitation requires user or application interaction with the library, and attack vectors depend on how Fabric.js is integrated into the target application. The issue was reported through the Trend Micro Zero Day Initiative and tracked as ZDI-CAN-29318.
Critical Impact
Attackers can coerce vulnerable applications into issuing unauthorized requests to internal or external network resources, leading to information disclosure through the Fabric.js loadFromJSON parser.
Affected Products
- Fabric.js JavaScript canvas library
- Applications embedding Fabric.js that invoke loadFromJSON on untrusted input
- Server-side rendering pipelines using Fabric.js with Node.js
Discovery Timeline
- 2026-09-15 - CVE-2026-19504 published to the National Vulnerability Database (NVD)
- 2026-09-15 - Last updated in NVD database
- Reference - Zero Day Initiative Advisory ZDI-26-588
Technical Details for CVE-2026-19504
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. Fabric.js exposes the loadFromJSON method to deserialize a canvas state from a JSON document. That JSON can reference external resources, such as image URLs, which the library subsequently fetches. The parser accepts URI values without enforcing a scheme allowlist or destination filter. An attacker who controls the JSON input can therefore direct Fabric.js to request arbitrary URLs.
When the library runs server-side, for example in a Node.js rendering worker, the outbound requests originate from the server. Attackers can target internal services, cloud metadata endpoints, or loopback interfaces that are not reachable from the public internet. Responses or error timing can then leak sensitive information back to the attacker through application behavior.
Root Cause
The root cause is missing URI validation inside loadFromJSON prior to resource retrieval. The method trusts user-supplied resource identifiers and issues network calls without verifying scheme, host, or destination reachability.
Attack Vector
Exploitation requires the application to pass attacker-influenced JSON to loadFromJSON. This commonly occurs in canvas import features, template restoration, and collaborative editing workflows. The attacker crafts a JSON document that references an internal URL, submits it through the normal application interface, and observes the server-side behavior for indications that the resource was fetched.
No verified public exploit code has been released. See the Zero Day Initiative Advisory ZDI-26-588 for additional technical details.
Detection Methods for CVE-2026-19504
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from Fabric.js worker processes to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.169.254).
- Application logs showing loadFromJSON invocations with resource URIs referencing file://, gopher://, or non-image endpoints.
- Unexpected DNS lookups from rendering hosts for cloud metadata hostnames.
Detection Strategies
- Instrument the application layer to log every URI resolved by Fabric.js and alert on non-allowlisted destinations.
- Deploy egress network monitoring that flags server-initiated connections to RFC1918 space, loopback, and cloud metadata IPs.
- Correlate JSON import events with subsequent outbound HTTP traffic to detect anomalous request chains.
Monitoring Recommendations
- Forward web application and reverse-proxy logs into a centralized analytics platform for cross-source correlation.
- Track outbound connection metadata per service account to baseline normal Fabric.js fetch behavior.
- Alert on repeated failed requests to internal endpoints, which often indicate SSRF probing.
How to Mitigate CVE-2026-19504
Immediate Actions Required
- Audit all application code paths that pass user-controlled data to Fabric.js loadFromJSON.
- Wrap the parser in a validation layer that rejects any URI not matching a strict allowlist of trusted hosts and schemes.
- Restrict outbound network access from servers running Fabric.js to only the destinations required for legitimate operation.
Patch Information
Consult the Zero Day Initiative Advisory ZDI-26-588 and the upstream Fabric.js project for the fixed release. Upgrade to the vendor-provided patched version once available, and re-test any application relying on loadFromJSON.
Workarounds
- Preprocess incoming JSON to strip or rewrite resource URIs before invoking loadFromJSON.
- Run Fabric.js server-side workloads in a network-isolated segment with no route to internal services or cloud metadata endpoints.
- Enforce an outbound proxy that filters requests by scheme, host, and IP category to block SSRF targets.
# Example iptables rules to block SSRF targets from a Fabric.js worker host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.