ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

CVE-2026-19504 is a Server-Side Request Forgery (SSRF) flaw in the open-source Fabric.js canvas library, disclosed by Trend Micro Zero Day Initiative as ZDI-26-588. The loadFromJSON method, which reconstructs a canvas from serialized JSON, does not properly validate URIs (such as image/asset URLs embedded in the JSON) before fetching them. If an application passes attacker-influenced JSON to loadFromJSON in a context where the library retrieves those URLs — most notably server-side Node.js image or canvas-rendering pipelines — an attacker can point those fetches at internal-only network resources and obtain sensitive information such as internal service responses or cloud metadata. Severity is rated medium (CVSS 3.0 score 4.0) with a local attack vector and high attack complexity, reflecting that exploitability depends heavily on how the library is integrated. No public proof-of-concept exists and there is no evidence of exploitation in the wild; the flaw is not on the CISA Known Exploited Vulnerabilities list.

Do: Upgrade Fabric.js to the latest release as soon as the vendor ships a patched version, since no fixed version range is yet published. Until then, do not pass untrusted or user-supplied JSON to loadFromJSON on the server: pre-scan the payload for src/href URL fields and enforce an allowlist (scheme, host, and public IP ranges, blocking RFC1918, link-local, and cloud metadata endpoints such as 169.254.169.254). Additionally, restrict outbound egress from servers that run Node-based rendering with Fabric.js so that even a successful SSRF cannot reach internal resources.