Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Description

Flowise introduced SSRF protections through a centralized HTTP security wrapper (httpSecurity.ts) that implements deny-list validation and IP pinning logic.

However, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axiosInstead of using the secured wrapper.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.13
• Patched version(s): 3.1.0

References

• GHSA-qqvm-66q4-vf5c
• CVE-2026-43995
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
• Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) - CVE-2026-41272
• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Security Testing of WebSites Using JavaScript

Tags:

npm

flowise-components