AI analysis
CVE-2026-19504 is a Server-Side Request Forgery (SSRF) flaw in the open-source Fabric.js canvas library, disclosed by Trend Micro Zero Day Initiative as ZDI-26-588. The loadFromJSON method, which reconstructs a canvas from serialized JSON, does not properly validate URIs (such as image/asset URLs embedded in the JSON) before fetching them. If an application passes attacker-influenced JSON to loadFromJSON in a context where the library retrieves those URLs — most notably server-side Node.js image or canvas-rendering pipelines — an attacker can point those fetches at internal-only network resources and obtain sensitive information such as internal service responses or cloud metadata. Severity is rated medium (CVSS 3.0 score 4.0) with a local attack vector and high attack complexity, reflecting that exploitability depends heavily on how the library is integrated. No public proof-of-concept exists and there is no evidence of exploitation in the wild; the flaw is not on the CISA Known Exploited Vulnerabilities list.
What to do: Upgrade Fabric.js to the latest release as soon as the vendor ships a patched version, since no fixed version range is yet published. Until then, do not pass untrusted or user-supplied JSON to loadFromJSON on the server: pre-scan the payload for src/href URL fields and enforce an allowlist (scheme, host, and public IP ranges, blocking RFC1918, link-local, and cloud metadata endpoints such as 169.254.169.254). Additionally, restrict outbound egress from servers that run Node-based rendering with Fabric.js so that even a successful SSRF cannot reach internal resources.
Affected
| Fabric.js project Fabric.js | — |
Estimated exposure
mass≈3M+ weekly npm downloads of the fabric package worldwide; the truly exploitable subset (server-side Node.js deployments feeding untrusted JSON to… — Fabric.js is one of the most widely used JavaScript canvas libraries on npm, so library footprint plausibly exceeds one million downstream projects, but SSRF impact requires server-side usage with attacker-influenced JSON, which cannot be…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the loadFromJSON method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker may be able to leverage this vulnerability to gain improper access to network resources. Was ZDI-CAN-29318.