npm/flowise CVE-2026-43995: critical 9.8, EPSS 0.40%

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Action: Upgrade flowise to 3.1.0 or later.

npm i flowise@3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-qqvm-66q4-vf5c
• nvd: CVE-2026-43995
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c
• https://github.com/FlowiseAI/Flowise

CVE-2026-43995 · published 2026-04-16T21:23:03Z · modified 2026-05-13T14:17:49.296266Z · JSON