CVE-2026-72904: Firecrawl SSRF Vulnerability

CVE-2026-72904 Overview

CVE-2026-72904 is an arbitrary file read and Server-Side Request Forgery (SSRF) vulnerability in Firecrawl, an open-source service that converts websites into LLM-ready markdown or structured data. The flaw resides in the extraction functionality, specifically in apps/api/src/lib/extract/helpers/dereference-schema.ts. The code invokes json-schema-ref-parser with default resolver settings, permitting external and local file references to be resolved during schema processing. An authenticated attacker can supply a malicious JSON schema containing $ref fields inside default, const, or enum values that bypass AJV validation. Firecrawl versions prior to 2.11.32 are affected.

Critical Impact
Authenticated attackers can read arbitrary files from the extract worker filesystem and issue SSRF requests to internal or external HTTP endpoints by triggering dereference errors that leak content through the extraction API.

Affected Products

Firecrawl versions prior to 2.11.32
apps/api/src/lib/extract/helpers/dereference-schema.ts extraction component
Deployments exposing the Firecrawl extraction API to authenticated users

Discovery Timeline

2026-08-10 - CVE-2026-72904 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72904

Vulnerability Analysis

Firecrawl's extraction service accepts user-supplied JSON schemas to shape structured output. The dereferenceSchema_F0 helper calls dereference() from @apidevtools/json-schema-ref-parser on untrusted input. By default, this parser resolves $ref pointers against the local filesystem and remote HTTP endpoints. AJV validation does not traverse default, const, or enum fields, so $ref entries hidden inside those keywords reach the resolver unchecked. When resolution fails, the underlying file or HTTP content is embedded in the error message. Firecrawl persists that error message and returns it through the extraction API, exfiltrating filesystem contents or internal HTTP responses to the requester. The issue is tracked under [CWE-77].

Root Cause

The root cause is unsafe default configuration of a third-party schema resolver combined with error messages that echo resolver output. The application trusted json-schema-ref-parser to handle arbitrary schemas without disabling file and HTTP resolvers, and validator coverage gaps in AJV allowed $ref smuggling through non-traversed keywords.

Attack Vector

An authenticated attacker submits an extraction request containing a crafted schema. The schema places $ref values pointing to file:///etc/passwd, internal metadata endpoints, or other sensitive URIs inside default, const, or enum fields. The extract worker attempts dereferencing, fails, and returns an error string containing the resolved content. Repeated requests enumerate files and reachable HTTP services.

typescript

// Security patch: replace vulnerable dereferencer
// apps/api/src/lib/extract/fire-0/extraction-service-f0.ts
   generateCompletions_F0,
   generateSchemaFromPrompt_F0,
 } from "./llmExtract-f0";
-import { dereferenceSchema_F0 } from "./helpers/dereference-schema-f0";
+import { dereferenceSchema } from "../helpers/dereference-schema";
 import { analyzeSchemaAndPrompt_F0 } from "./completions/analyzeSchemaAndPrompt-f0";

// Removed vulnerable helper:
// apps/api/src/lib/extract/fire-0/helpers/dereference-schema-f0.ts
-import { dereference } from "@apidevtools/json-schema-ref-parser";
-
-export async function dereferenceSchema_F0(schema: any): Promise<any> {
-  try {
-    return await dereference(schema);
-  } catch (error) {
-    console.error("Failed to dereference schema:", error);
-    throw error;
-  }
-}

Source: Firecrawl GitHub Commit 053630fc

Detection Methods for CVE-2026-72904

Indicators of Compromise

Extraction API requests containing JSON schemas with $ref values pointing to file://, http://169.254.169.254, or other internal URIs
Persisted extraction errors containing filesystem paths such as /etc/passwd, /proc/self/environ, or application configuration files
$ref tokens nested inside default, const, or enum schema keywords
Outbound HTTP connections from extract workers to cloud metadata services or internal-only hosts

Detection Strategies

Inspect Firecrawl API request bodies for JSON schemas containing $ref keys and alert on non-HTTPS or internal targets
Parse extraction error logs for file paths, PEM blocks, or environment variable content indicating leaked contents
Correlate extract worker egress traffic against an allowlist of expected crawl destinations

Monitoring Recommendations

Log full request payloads for the extraction endpoint and retain error responses for review
Alert on any resolver errors referencing file: or localhost URI schemes
Track process-level file reads from Firecrawl worker containers using runtime monitoring

How to Mitigate CVE-2026-72904

Immediate Actions Required

Upgrade Firecrawl to version 2.11.32 or later on all API and extract worker nodes
Rotate any credentials, API keys, or secrets that were readable from the extract worker filesystem
Review extraction API logs for schemas containing $ref inside default, const, or enum fields
Restrict extract worker egress to required crawl targets and block cloud metadata endpoints

Patch Information

The fix is delivered in Firecrawl 2.11.32. The patch replaces json-schema-ref-parser with an internal-only $ref resolver that refuses filesystem and remote HTTP references. See the Firecrawl Security Advisory GHSA-3p54-jg6f-68r8 and the remediation commit.

Workarounds

Run extract workers in isolated containers with read-only filesystems and no access to sensitive host paths
Apply a reverse-proxy filter that rejects requests where the JSON schema body contains $ref tokens
Block outbound traffic from extract workers to 169.254.169.254 and RFC1918 ranges when not required

bash

# Upgrade Firecrawl to the patched version
npm install firecrawl@2.11.32

# Or pull the patched container image and redeploy
docker pull firecrawl/firecrawl:2.11.32
docker compose up -d

# Verify the running version
curl -s http://localhost:3002/v1/version