Description
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
- Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) - CVE-2026-41272
- Papra HTTP redirect bypass can lead to SSRF via webhook delivery system - CVE-2026-48051
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
You might also like:
See something that needs correcting? Let us knowUpdated April 27, 2026