Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Description

A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.13
• Patched version(s): 3.1.0

References

• GHSA-xhmj-rg95-44hv
• CVE-2026-41270
• CWE-284
• CWE-918
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
• Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) - CVE-2026-41272
• Papra HTTP redirect bypass can lead to SSRF via webhook delivery system - CVE-2026-48051
• Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

flowise-components