CVE-2026-35409: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35409 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw allows attackers to circumvent the IP address deny-list intended to block requests to local and private networks by using IPv4-Mapped IPv6 address notation. All versions of the directus npm package prior to 11.16.0 are affected. The vulnerability was published on April 2, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Github Advisory).

The root cause is improper input validation (CWE-20) in Directus's SSRF protection mechanism (CWE-918). Directus maintains an IP deny-list to block server-side requests to internal and private network ranges, but the validation logic failed to normalize IPv4-Mapped IPv6 addresses (e.g., ::ffff:127.0.0.1 as the IPv6 representation of 127.0.0.1) before checking them against the deny-list. Because the deny-list check did not recognize these mapped addresses as equivalent to their IPv4 counterparts, an attacker could supply a URL using IPv4-Mapped IPv6 notation, bypass the restriction, and have the underlying HTTP client and OS resolve and connect to the intended private target. The fix adds a normalization step that converts IPv4-Mapped IPv6 addresses to their canonical IPv4 form prior to validation (GitHub Advisory).

Successful exploitation allows an authenticated user — or an unauthenticated user if public file-import permissions are enabled — to perform SSRF attacks against internal services co-located with the Directus instance, including databases, caches, and internal APIs. Attackers can also reach cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254, GCP, or Azure equivalents), potentially exposing cloud credentials and enabling further lateral movement within the environment. The primary impact is high confidentiality loss with no integrity or availability impact, and the changed scope indicates that resources beyond the vulnerable component itself are at risk (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account, unless the Directus instance has public file-import permissions enabled, which would lower the barrier to unauthenticated exploitation.

1. Reconnaissance: Identify a Directus instance running a version prior to 11.16.0. Determine whether public file-import permissions are enabled (allowing unauthenticated exploitation) or obtain low-privileged credentials.
2. Identify the file import endpoint: Locate the Directus file import API endpoint (e.g., POST /files/import), which accepts a URL from which Directus fetches and imports a file.
3. Craft the bypass payload: Instead of supplying a standard private IP address (e.g., http://127.0.0.1/) that would be blocked by the deny-list, construct a URL using IPv4-Mapped IPv6 notation, such as http://[::ffff:127.0.0.1]/ or http://[::ffff:169.254.169.254]/latest/meta-data/ for cloud metadata.
4. Submit the request: Send the crafted file import request to the Directus API with the IPv4-Mapped IPv6 URL. The deny-list check fails to recognize the address as private and permits the request.
5. Retrieve internal data: The Directus server fetches the content from the internal target (e.g., cloud IMDS credentials, internal API responses) and returns or stores it, allowing the attacker to exfiltrate sensitive information (GitHub Advisory).

• Network: Outbound HTTP requests from the Directus server process to internal IP ranges (e.g., 127.0.0.1, 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints, particularly using IPv6-formatted addresses (::ffff: prefix).
• Logs: Directus application logs showing file import requests with URLs containing IPv4-Mapped IPv6 notation (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254); HTTP access logs recording POST requests to /files/import with suspicious URL parameters.
• File System: Unexpected files stored in the Directus media library containing content from internal services (e.g., JSON responses from cloud metadata APIs, internal API data).
• Process: Unusual outbound TCP connections from the Node.js Directus process to loopback or link-local addresses observable via netstat or endpoint detection tools.

Upgrade Directus to version 11.16.0 or later, which includes a normalization step that converts IPv4-Mapped IPv6 addresses to their canonical IPv4 form before deny-list validation (GitHub Advisory). As a temporary workaround, administrators should disable public file-import permissions to prevent unauthenticated exploitation, and restrict file-import capabilities to only trusted, highly privileged users. Additionally, network-level controls (e.g., egress firewall rules blocking the Directus server from reaching internal IP ranges and cloud metadata endpoints) can reduce the blast radius while patching is pending.

The vulnerability was reported by security researchers alissonbezerra and odgrso and published by the Directus maintainer br41nslug via GitHub Security Advisories on April 2, 2026 (GitHub Advisory). Brief mentions appeared on Mastodon and Bluesky CVE tracking accounts shortly after NVD publication, but no significant broader media coverage or notable researcher commentary has been identified.