CVE-2026-69257

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Flowise contains a Server-Side Request Forgery (SSRF) flaw in its HTTP security module httpSecurity.ts. The isDeniedIP() function fails to normalize IPv4-mapped IPv6 addresses (such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254) before validating them against the deny list. Because the ipaddr.js library identifies these as ipv6 while the deny-list entries are ipv4, the system skips the IPv4 CIDR checks entirely.

An attacker controlling DNS resolution for a hostname can return a AAAA record for an IPv4-mapped target, bypassing SSRF protections to access localhost, internal services, or cloud metadata endpoints. This issue affects code paths using the following functions:

Recommendations Update Flowise to version 3.1.3. As a temporary mitigation, restrict access to the httpSecurity.ts module or avoid using the secureAxiosRequest(), secureFetch(), and checkDenyList() functions for untrusted hostnames until the update is applied.