CVE-2026-19504

Executive Summary

CVE-2026-19504 is a Server-Side Request Forgery (SSRF) vulnerability in the Fabric.js loadFromJSON method, arising from missing validation of a URI before network resources are accessed (CWE-918). The flaw is exploitable by remote attackers and requires the application to interact with the vulnerable library, meaning the attack surface is limited to server-side deployments of Fabric.js that deserialize attacker-influenceable JSON. Successful exploitation can expose sensitive information and grant improper access to internal network resources; ZDI tracks this as ZDI-CAN-29318. With a CVSS 3.0 base score of 4.0, EPSS of 0.00117, no public PoC, no Nuclei template, no CISA KEV listing, and no patch evidence (0/4 confidence), the immediate exploitation likelihood is low but the vulnerability remains fully unpatched.

Technical Analysis

The vulnerability class is Server-Side Request Forgery (SSRF), mapped to CWE-918. The NVD description states the specific flaw exists within the implementation of the loadFromJSON method. The root cause is a direct consequence of that method's design: server-side Fabric.js deserialization supports loading external resources referenced within canvas JSON. Because the method fails to validate a URI prior to accessing resources, an attacker who can supply or influence the JSON document passed to loadFromJSON can cause the server to initiate outbound requests to a URI under the attacker's control.

Two technical properties are confirmed by the data provided:

1. The vulnerable sink is the loadFromJSON method of Fabric.js.
2. The mechanism is "lack of proper validation of a URI prior to accessing resources."

This places the flaw in the resource-loading/deserialization path rather than in the JSON parser itself. Fabric.js canvas JSON can reference external resources (e.g., images or cross-origin elements) that the library fetches on behalf of the deserialized object. Where that fetch occurs server-side (for example, in Node.js environments using Fabric.js for headless canvas rendering, server-side image compositing, or JSON-driven rendering pipelines), the fetching runtime inherits the server's network position and credentials. The absence of a URI allow-list, scheme restriction, or private-address blocklist is the validation gap that constitutes CWE-918.

The CVSS vector indicates the attacker's access vector is Local (AV:L) with High attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). This is notable: although the CNA title calls this a "Server-Side Request Forgery" and the description states it "allows remote attackers to disclose sensitive information," the scoring reflects that exploitation is conditional — the attacker must be able to influence the JSON consumed by loadFromJSON, and the request is made by the server's own runtime against a target whose reachability is attacker-dependent. Confidentiality and Integrity impacts are Low (C:L/I:L), Availability is None (A:N), and the scope is Unchanged (S:U). The description explicitly notes that "attack vectors may vary depending on the implementation," so blast radius is highly deployment-dependent.

No affected version range, OSV package data, or vendor advisory has been published in the supplied intelligence. Insufficient technical detail is available to specify internal function-level mechanics beyond the loadFromJSON sink and the missing URI validation; no URL endpoints, file paths, or parameter names are disclosed in the source data and none are asserted here.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-19504 (POC_STATUS: None; Nuclei template: NO). The following chain is therefore inferred strictly from the vulnerability class (SSRF) and the confirmed sink (loadFromJSON), without fabricating implementation details.

1. Reconnaissance / target identification. The attacker identifies an application that performs server-side deserialization of Fabric.js canvas JSON — typical patterns include headless rendering services, server-side image/PDF generation pipelines, collaborative canvas backends, and thumbnail or preview generation APIs that accept client-supplied "canvas" or "design" documents. Identification can be performed through normal application interaction (submitting a canvas JSON document and observing server-side fetch behavior) and through Shodan enumeration of hosts serving Fabric.js assets.

2. Triggering the flaw class. The attacker crafts or modifies a Fabric.js JSON document so that a resource reference inside it points to a URI of the attacker's choosing, and submits that document to the application. When the server invokes loadFromJSON on the untrusted document, the library attempts to load the referenced resource. Because the URI is not validated prior to resource access, the server-side runtime issues the request to the attacker-specified destination.

3. Payload / execution method. Consistent with CWE-918, the payload is the malicious JSON document and the destination URI embedded within it. No specific Fabric.js function names, parameter names, or URI schemes are disclosed in the available data, so the exact object key or property used to carry the URI is not asserted. The mechanism-level requirement is simply that the embedded URI survives deserialization and is dereferenced by the library on the server side. The description explicitly notes that "interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation."

4. Post-exploitation impact. Per the NVD description, successful exploitation allows the attacker to "disclose sensitive information" and to "gain improper access to network resources." In SSRF terms this can mean reaching internal-only HTTP services, cloud instance metadata endpoints reachable from the server's network position, or internal administrative interfaces, and exfiltrating their responses if the application reflects fetched resource data back to the attacker. Confidentiality and Integrity impacts are rated Low (C:L/I:L); Availability is not affected (A:N). Because exploitation is implementation-dependent, the realized impact depends entirely on the network position and privileges of the vulnerable server-side Fabric.js deployment.

Impact Assessment

Business impact is concentrated in organizations that deserialize untrusted or semi-trusted Fabric.js JSON on the server side. The most exposed use cases are multi-tenant design/collaboration platforms, headless rendering and document-generation services, and any API that accepts a canvas JSON document from a client and renders it server-side. In such deployments the vulnerable process frequently sits inside a trusted network segment, making it a useful pivot for internal reconnaissance.

Per CVSS 3.0 (4.0 base, AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N): the attacker must have a local access path into the process that supplies the JSON, and attack complexity is High because success depends on implementation specifics and on whether the chosen URI is reachable and its response observable. No privileges are required (PR:N) and no user interaction is needed (UI:N). Confidentiality and Integrity impacts are Low; Availability is None; the vulnerable component and impacted component are the same (Scope Unchanged), so cross-boundary escalation is not asserted by the vector.

Blast radius is bounded by the server's network reachability and its service credentials. EPSS (0.00117, ~1.9th percentile) and the absence of CISA KEV listing, PoC code, and Nuclei templates indicate no evidence of active exploitation as of this report. However, patch confidence is 0/4 — no vendor fix has been identified from any tracked source — so every affected deployment remains potentially vulnerable indefinitely.

Detection Guidance

Sigma Rule

title: Potential Fabric.js loadFromJSON SSRF via Untrusted Canvas JSON
id: 8b2f5c7e-1950-4a4d-9c3a-7e6d2f1b0a44
status: experimental
description: Detects server-side processes handling Fabric.js canvas JSON that initiate outbound HTTP requests to private or loopback address space, consistent with SSRF via the loadFromJSON method (CVE-2026-19504).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19504
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1090
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/nodejs'
  selection_json:
    CommandLine|contains:
      - 'loadFromJSON'
      - 'fabric'
      - 'canvas'
  selection_net:
    CommandLine|re: '(127\.0\.0\.1|169\.254\.169\.254|10\.[0-9]{1,3}\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'
  condition: selection_proc and (selection_json or selection_net)
falsepositives:
  - Legitimate server-side rendering jobs that fetch internal assets
  - Node.js build tooling and CI pipelines
level: medium

YARA Rule

rule CVE_2026_19504_FabricJS_SSRF
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        description = "Detects Fabric.js canvas JSON documents containing loadFromJSON usage or embedded private/internal URIs indicative of SSRF payloads for CVE-2026-19504"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-19504"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $fabric1 = "loadFromJSON" ascii wide
        $fabric2 = "fabric." ascii wide nocase
        $json1   = "\"objects\"" ascii
        $src1    = "\"src\":" ascii
        $src2    = "\"src\" :" ascii

        $priv1   = "http://127.0.0.1" ascii nocase
        $priv2   = "http://localhost" ascii nocase
        $priv3   = "http://169.254.169.254" ascii nocase
        $priv4   = "http://10." ascii nocase
        $priv5   = "http://192.168." ascii nocase
        $priv6   = "http://172.16." ascii nocase
        $priv7   = "http://172.17." ascii nocase
        $priv8   = "file://" ascii nocase

    condition:
        uint32(0) != 0x04034b50 and
        filesize < 5MB and
        (
            (any of ($fabric*) and any of ($src*)) or
            (any of ($json1) and 1 of ($priv*)) or
            (2 of ($priv*))
        )
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-19504 Fabric.js loadFromJSON SSRF to Internal Resource"; flow:established,to_server; content:"POST"; http_method; content:"application/json"; http_header; content:"loadFromJSON"; http_client_body; nocase; pcre:"/(\"src\"\s*:\s*\")(https?:\/\/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)|file:\/\/)/i"; reference:cve,CVE-2026-19504; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19504; classtype:attempted-recon; sid:202619504; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium;)

Elastic Detection

process where process.name in ("node", "nodejs")
  and process.command_line != null
  and (
    process.command_line : "loadFromJSON" or
    process.command_line : "*fabric*" or
    process.command_line : "*\"src\":*" or
    process.command_line regex ".*(127\\.0\\.0\\.1|169\\.254\\.169\\.254|10\\.[0-9]+\\.[0-9]+\\.[0-9]+|192\\.168\\.[0-9]+\\.[0-9]+).*"
  )

Splunk SPL Query

index=network OR index=proxy OR index=web
| eval body=coalesce(http_request_body, request_body, null)
| where (match(body, "(?i)loadFromJSON") OR match(body, "(?i)fabric"))
  AND (match(body, "(?i)https?://(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)") OR match(body, "(?i)file://"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, url, http_user_agent
| where count > 0
| sort - count
| rename src_ip as "Source IP", dest_ip as "Destination IP", url as "Target URL", http_user_agent as "User-Agent"

Wazuh OSSEC Rule

<group name="web,fabricjs,ssrf,">
  <rule id="100504" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_request_body">loadFromJSON</field>
    <regex>127\.0\.0\.1|localhost|169\.254\.169\.254|10\.[0-9]+\.[0-9]+\.[0-9]+|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.</regex>
    <description>CVE-2026-19504 - Possible Fabric.js loadFromJSON SSRF attempt with internal URI target</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_19504,</group>
  </rule>

  <rule id="100505" level="8">
    <decoded_as>json</decoded_as>
    <field name="http_request_body">loadFromJSON</field>
    <description>CVE-2026-19504 - Fabric.js loadFromJSON deserialization of untrusted canvas JSON</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_19504,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range has been published in the supplied intelligence, and no OSV package data is available. This means no confirmed remediation exists; the measures below are compensating controls only.

1. Immediate mitigations (compensating controls).

   • Treat all JSON documents passed to loadFromJSON as untrusted input. Do not accept canvas JSON for server-side deserialization from unauthenticated or unauthorized clients.
   • Enforce egress filtering on any host that runs server-side Fabric.js. Block outbound traffic to loopback, link-local (including the cloud metadata address space), and private RFC1918 ranges from application processes, and restrict outbound access to an explicit allow-list of permitted destinations.
   • Where the application controls resource loading, restrict URI schemes and hostnames to a strict allow-list and disallow schemes such as file://. Note: because the flaw is that validation is missing inside the library, any such filtering must be implemented in the calling application until a vendor fix is available.
   • Apply least privilege to the service account and runtime: deny access to cloud instance metadata endpoints, restrict IAM roles, and remove unnecessary network path reachability to internal administrative interfaces.
   • Isolate server-side Fabric.js rendering workloads in a segmented network zone with no direct access to sensitive internal services.

2. Patch / upgrade steps.

   • No patch is currently available from any tracked source. Monitor the Fabric.js project repository, release notes, and the NVD record for CVE-2026-19504 for a vendor-issued fix.
   • Once a fixed version is released, upgrade Fabric.js to that version and re-test all server-side deserialization paths. Because no fixed version has been identified, no upgrade target can be specified at this time.
   • If the project publishes an advisory with a CVE-linked fix commit, verify the fix addresses URI validation in the loadFromJSON resource-loading path specifically.

3. Long-term hardening.

   • Adopt a deny-by-default outbound network policy for all application tiers that process user-supplied structured documents.
   • Add input validation at trust boundaries: validate schema, reject embedded external URI references, or rewrite them to a controlled proxy when server-side deserialization is unavoidable.
   • Instrument deserialization endpoints with logging of resource-fetch destinations so SSRF attempts are visible even when blocked.
   • Track CWE-918 as a recurring class in code review and threat modeling for any library that fetches resources on behalf of parsed input.

References

1. NVD — CVE-2026-19504: https://nvd.nist.gov/vuln/detail/CVE-2026-19504
2. CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. Zero Day Initiative — ZDI-CAN-29318 (case identifier referenced in the NVD description): https://www.zerodayinitiative.com/advisories/
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Fabric.js project repository and release notes (monitor for a future fix): https://github.com/fabricjs/fabric.js/releases

Threat actor campaign evidence: none identified. CISA KEV: not listed. Public exploit code / PoC: none. Nuclei template: none. EPSS 0.00117 (~1.9th percentile) indicates low predicted exploitation activity. Given patch confidence of 0/4, the vulnerability should be tracked for remediation once a vendor fix is published.