npm/flowise-components CVE-2026-43995: critical 9.8, EPSS 0.40%

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Action: Upgrade flowise-components to 3.1.0 or later.

npm i flowise-components@3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-qqvm-66q4-vf5c#npm/flowise-components
• nvd: CVE-2026-43995
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c
• https://github.com/FlowiseAI/Flowise

CVE-2026-43995 · published 2026-04-16T21:23:03Z · modified 2026-05-13T14:17:49.296266Z · JSON