A similar problem with the join node was because it was modifying the message after sending it, the change in the order that messages are handled meant that it worked ok (usually) in earlier versions of node red. I suspect there is a similar issue with the contrib node.
@snowjimmy This is a bug with the snmp node that has been lurking for a long time - and yes, the move to async has brought it more obviously to the surface.
I've just published version 0.0.22 with the fix in.
Side note; how do updates to jsonata arrive in NR ?
We have an open issue to upgrade jsonata to 1.7 - a bit more involved then just bumping a version as it introduces some new functions to document etc.
Won't be in 1.0.2.
1 Like
Congrats! 
and Thanks!
Hi, I just installed the latest version of node-red on a new machine.
It is the first time I see this vulnerability in node-red. Is it possible that it affects my flow?
That module is only used by the MQTT nodes if they are configured to connect over WebSockets and you are running behind an HTTP proxy.
We'll publish 1.0.3 soon which updates this dependency.
2 Likes
v1.0.1 I no longer see the option to disable a flow tab. Has it moved?
It has moved to the bottom left of the "edit flow" dialog. I guess for consistency with the new "disable node" feature introduced in v1.0.
Thanks! 2020 Fresh start!
