Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/api/src/lib/extract/helpers/dereference-schema.ts. The affected code invokes the json-schema-ref-parser dependency with default resolver settings, al [truncated]
The CVE record for CVE-2026-32857 was published on 2026-03-26T18:16:28.953Z and has not been modified since then. The NVD entry is currently Deferred. This SSRF protection bypass vulnerability in Firecrawl version 2.8.0 and prior allows attackers to gain access to internal network services and sensitive endpoints. The vulnerability arises from a post-redirect enforcement gap in implemented SSRF protection [truncated]
