Firecrawl patches access to internal network services

What happened

An attacker-controlled website could make Firecrawl’s browser service contact private network services after its address check had passed. The attacker changes the hostname’s answer between validation and connection.

The issue was reported on 20 October and its fix merged on 21 October. The CVE was published on 25 October and describes versions before 2.11.586 as affected. The fix binds the connection to the address already checked. Deployments using an upstream proxy still need that proxy to enforce its own network-access restrictions.