Firecrawl vulnerabilities

CVEs whose affected-version data names the Firecrawl package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116066Medium· 6.8

yesterday

Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target ca…

▾ SunlitFirecrawl · Firecrawlvia CVEORG