Use of Password Hash With Insufficient Computational Effort Affecting flowise package, versions <3.0.13
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Use of Password Hash With Insufficient Computational Effort vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-FLOWISE-15435876
- published6 Mar 2026
- disclosed5 Mar 2026
- creditUnknown
Introduced: 5 Mar 2026
New CVE NOT AVAILABLE CWE-916 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade flowise to version 3.0.13 or higher.
Overview
flowise is a Flowiseai Server
Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort due to the use of insufficient bcrypt salt rounds in the getHash() function. An attacker can significantly reduce the time required to crack password hashes by performing brute-force attacks if they gain access to the hashed passwords.