CVE-2026-116066

Name of the Vulnerable Software and Affected Versions Firecrawl versions prior to 2.11.586

Description A server-side request forgery (SSRF) issue exists in the Playwright service SSRF proxy. This allows attackers to bypass isInternalHost checks using DNS rebinding, a technique where a domain name resolves to different IP addresses at different times. By controlling the DNS of a scrape target, an attacker can provide a public address during the initial validation and a private address during the connection phase, enabling the retrieval of internal resources and cloud metadata through the scrape API.

Recommendations Update to version 2.11.586 or later.