CVE-2026-69257
Summary
Flowise's HTTP security module (httpSecurity.ts) fails to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list. Due to an ipaddr.js kind mismatch (ipv6 vs ipv4), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to ::ffff:<target_ipv4>, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost.
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
- CWE-1389: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check)
Affected Versions
- All versions up to and including v3.1.1 (latest main branch as of 2026-04-03)
- This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+)
Details
Root Cause
The isDeniedIP() function in packages/components/src/httpSecurity.ts checks IP addresses against a deny list using ipaddr.js. The critical flaw is in the kind() comparison:
// httpSecurity.ts - isDeniedIP()
export function isDeniedIP(ip: string, denyList: string[]): void {
const parsedIp = ipaddr.parse(ip);
for (const entry of denyList) {
if (entry.includes('/')) {
try {
const [range, _] = entry.split('/')
const parsedRange = ipaddr.parse(range)
// ⚠️ BUG: IPv4-mapped IPv6 has kind='ipv6', IPv4 CIDR has kind='ipv4'
// This condition is FALSE for ::ffff:x.x.x.x vs any IPv4 CIDR entry
if (parsedIp.kind() === parsedRange.kind()) { // <-- BYPASS HERE
if (parsedIp.match(ipaddr.parseCIDR(entry))) {
throw new Error('Access to this host is denied by policy.')
}
}
} catch (error) {
throw new Error(isDeniedIP: ${error})
}
} else if (ip === entry) {
throw new Error('Access to this host is denied by policy.')
}
}
}
When the resolved IP is an IPv4-mapped IPv6 address like ::ffff:169.254.169.254:
- ipaddr.parse('::ffff:169.254.169.254').kind() returns 'ipv6'
- ipaddr.pa
⚡ Watch CVE-2026-69257
Get an email if CVE-2026-69257 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-69257)