{"items":[{"id":"NVI-00015418","kind":"vulnerability","title":"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c6xh-wv4j-ppv5","CVE-2026-69257"],"plain_summary":"GitHub lists this reviewed advisory for flowise. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-635e110d42d1149656b6dfb26bdee22c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-24T16:10:00.153Z","value":"8.6 HIGH (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-635e110d42d1149656b6dfb26bdee22c"},{"kind":"CVSS","as_of":"2026-10-24T16:10:00.153Z","value":"7.6 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-635e110d42d1149656b6dfb26bdee22c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6672aab766452a1bdba581265c87c35d","url":"https://github.com/advisories/GHSA-c6xh-wv4j-ppv5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c6xh-wv4j-ppv5","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:33.950Z"},{"id":"sr-635e110d42d1149656b6dfb26bdee22c","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69257","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-69257","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T15:07:54.921Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6672aab766452a1bdba581265c87c35d"],"technology":"flowise","known_exclusions":[],"conditions_summary":"## Summary\n\nFlowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to `::ffff:`, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost.\n\n## CWE\n\n- **CWE-918**: Server-Side Request Forgery (SSRF)\n- **CWE-1389**: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check)\n\n## Affected Versions\n\n- All versions up to and including **v3.1.1** (latest main branch as of 2026-04-03)\n- This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+)\n\n## Details\n\n### Root Cause\n\nThe `isDeniedIP()` function in `packages/components/src/httpSecurity.ts` checks IP addresses against a deny list using `ipaddr.js`. The critical flaw is in the `kind()` comparison:\n\n```typescript\n// httpSecurity.ts - isDeniedIP()\nex","public_affected_ranges":["<= 3.1.2"]}],"null_published_at":"2026-11-08T19:53:44.063Z","source_updated_at":"2026-08-04T15:51:59.000Z","source_disclosed_at":"2026-08-04T15:51:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T09:58:33.950Z"},{"id":"NVI-00015418","kind":"vulnerability","title":"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c6xh-wv4j-ppv5","CVE-2026-69257"],"plain_summary":"GitHub lists this reviewed advisory for flowise. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6672aab766452a1bdba581265c87c35d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6672aab766452a1bdba581265c87c35d","url":"https://github.com/advisories/GHSA-c6xh-wv4j-ppv5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c6xh-wv4j-ppv5","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:33.950Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6672aab766452a1bdba581265c87c35d"],"technology":"flowise","known_exclusions":[],"conditions_summary":"## Summary\n\nFlowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to `::ffff:`, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost.\n\n## CWE\n\n- **CWE-918**: Server-Side Request Forgery (SSRF)\n- **CWE-1389**: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check)\n\n## Affected Versions\n\n- All versions up to and including **v3.1.1** (latest main branch as of 2026-04-03)\n- This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+)\n\n## Details\n\n### Root Cause\n\nThe `isDeniedIP()` function in `packages/components/src/httpSecurity.ts` checks IP addresses against a deny list using `ipaddr.js`. The critical flaw is in the `kind()` comparison:\n\n```typescript\n// httpSecurity.ts - isDeniedIP()\nex","public_affected_ranges":["<= 3.1.2"]}],"null_published_at":"2026-11-03T10:03:31.364Z","source_updated_at":"2026-08-04T15:51:59.000Z","source_disclosed_at":"2026-08-04T15:51:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:58:33.950Z"}],"next_cursor":null,"snapshot_revision":"42594"}