NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Description

NocoBase’s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.

Recommendation

Update the @nocobase/plugin-workflow-request package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.37
• Patched version(s): 2.0.37

References

• GHSA-mvvv-v22x-xqwp
• CVE-2026-40346
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
• Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nocobase/plugin-workflow-request