Description
Flowise introduced SSRF protections through a centralized HTTP security wrapper (httpSecurity.ts) that implements deny-list validation and IP pinning logic.
However, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axiosInstead of using the secured wrapper.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
- Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) - CVE-2026-41272
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2026