Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
Summary
Flowise's HTTP security module (httpSecurity.ts) fails to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list. Due to an ipaddr.js kind mismatch (ipv6 vs ipv4), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to ::ffff:<target_ipv4>, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost.
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
- CWE-1389: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check)
Affected Versions
- All versions up to and including v3.1.1 (latest main branch as of 2026-04-03)
- This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+)
Details
Root Cause
The isDeniedIP() function in packages/components/src/httpSecurity.ts checks IP addresses against a deny list using ipaddr.js. The critical flaw is in the kind() comparison:
```typescript
// httpSecurity.ts - isDeniedIP()
export function isDeniedIP(ip: string, denyList: string[]): void {
const parsedIp = ipaddr.parse(ip);
for (const entry of denyList) {
if (entry.includes('/')) {
try {
const [range, _] = entry.split('/')
const parsedRange = ipaddr.parse(range)
// ⚠️ BUG: IPv4-mapped IPv6 has kind='ipv6', IPv4 CIDR has kind='ipv4'
// This condition is FALSE for ::ffff:x.x.x.x vs any IPv4 CIDR entry
if (parsedIp.kind() === parsedRange.kind()) { // <-- BYPASS HERE
if (parsedIp.match(ipaddr.parseCIDR(entry))) {
throw new Error('Access to this host is denied by policy.')
}
}
} catch (error) {
throw new Error(isDeniedIP: ${error})
}
} else if (ip === entry) {
throw new Error('Access to this host is denied by policy.')
}
}
}
```
When the resolved IP is an IPv4-mapped IPv6 address like ::ffff:169.254.169.254:
ipaddr.parse('::ffff:169.254.169.254').kind() returns 'ipv6'ipaddr.parse('169.254.169.254').kind() (from deny list entry) returns 'ipv4''ipv6' === 'ipv4' is false → CIDR check is completely skipped
The IPv6 deny list entries (::1, fc00::/7, fe80::/10, ff00::/8) do NOT cover the ::ffff:0:0/96 range where IPv4-mapped addresses live, so these addresses bypass ALL deny rules.
Attack Vector
1. Attacker registers a domain (e.g., evil.attacker.com) and sets a AAAA DNS record to ::ffff:169.254.169.254 (AWS metadata) or ::ffff:10.0.0.1 (internal service)
2. Attacker configures a chatflow HTTP Node (or API Chain, Document Loader, etc.) to make a request to http://evil.attacker.com/latest/meta-data/
3. resolveAndValidate() calls dns.lookup('evil.attacker.com', { all: true }) which returns [{ address: '::ffff:169.254.169.254', family: 6 }]
4. isDeniedIP('::ffff:169.254.169.254', denyList) is called — all IPv4 CIDR entries are skipped due to kind mismatch
5. Request is sent to 169.254.169.254 (AWS metadata service) via the IPv4-mapped IPv6 address
Affected Endpoints
All code paths using the SSRF protection functions are vulnerable:
| Function | Usage Count | Affected Components |
|----------|:-----------:|-------------------|
| secureAxiosRequest() | 8+ | HTTP Node (Agentflow), ExecuteFlow, APILoader, FireCrawl, Spider, AzureRerank |
| secureFetch() | 5+ | ApiChain, Custom Function sandbox, Jira tool, MCP tool |
| checkDenyList() | 3+ | MCP Server URL validation, fetch-links service, web scraping |
Proof of Concept
```javascript
// Verify the bypass using ipaddr.js (same library Flowise uses)
const ipaddr = require('ipaddr.js');
const denyList = [
'169.254.169.254/16', // Cloud metadata (covered by 169.254.0.0/16 in Flowise)
'10.0.0.0/8', // RFC1918 (covered by 10.0.0.0/8 in Flowise)
'127.0.0.0/8', // Loopback (covered by 127.0.0.0/8 in Flowise)
'172.16.0.0/12', // RFC1918 (covered by 172.16.0.0/12 in Flowise)
'192.168.0.0/16', // RFC1918 (covered by 192.168.0.0/16 in Flowise)
];
// Normal IPv4 - correctly blocked
const normalIP = ipaddr.parse('169.254.169.254');
console.log('169.254.169.254 kind:', normalIP.kind()); // 'ipv4'
// IPv4-mapped IPv6 - bypasses ALL checks
const mappedIP = ipaddr.parse('::ffff:169.254.169.254');
console.log('::ffff:169.254.169.254 kind:', mappedIP.kind()); // 'ipv6'
console.log('Is IPv4Mapped?:', mappedIP.isIPv4MappedAddress()); // true
console.log('Maps to:', mappedIP.toIPv4Address().toString()); // '169.254.169.254'
// Demonstrate the bypass
for (const entry of denyList) {
co
