# The flows disappear

**URL:** <https://discourse.nodered.org/t/the-flows-disappear/89474>\
**Category:** General\
**Tags:** security\
**Created:** [14 July 2024 09:29 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474 "2024-07-14T09:29:50Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![XavierTGN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/xaviertgn/32/92805_2.png) [@XavierTGN](https://discourse.nodered.org/u/XavierTGN)\
**Post date:** [14 July 2024 09:29 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/1 "2024-07-14T09:29:50Z")

</div>

Hello.  
I have a problem with node-red that I don't know what to do anymore.  
Every so often, varying between two weeks and 2 or 3 days, the system deletes all the data in the flows.json file and the flows **disappear.**

_Versions:_  
Node-RED v4.0.0  
Node.js v20.14.0  
MariaDb  
MQTT  
Debian without desktop  
Distributor ID: Debian  
Description: Debian GNU/Linux 12 (bookworm)  
Release: 12  
Codename: bookworm

Two months ago I changed from Raspberry Pi 3B to 4, I installed everything from scratch, but the problem persists.  
I have a home automation application, temperatures, smoke detectors, etc., and I can't trust the system anymore.

Has anyone had the same problem?

Thanks for everything

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 09:34 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/2 "2024-07-14T09:34:32Z")

</div>

Hi @XavierTGN, welcome to the forum.

Have you ever made your Node-red setup accessible from the internet?

---

<div class="post-metadata">

**Author:** ![XavierTGN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/xaviertgn/32/92805_2.png) [@XavierTGN](https://discourse.nodered.org/u/XavierTGN)\
**Post date:** [14 July 2024 09:40 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/3 "2024-07-14T09:40:08Z")

</div>

Hello jbudd.  
No, but can I copy it here?  
Or should I put it on Github?

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 09:43 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/4 "2024-07-14T09:43:57Z")

</div>

No no no, I don't want to access your Node-red, I wanted to find out if you might have been hacked, which would be possible if (for example) you had set up port forwarding on your router.

---

<div class="post-metadata">

**Author:** ![XavierTGN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/xaviertgn/32/92805_2.png) [@XavierTGN](https://discourse.nodered.org/u/XavierTGN)\
**Post date:** [14 July 2024 09:54 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/5 "2024-07-14T09:54:46Z")

</div>

If I have port 1880 open to access from the Internet.

---

<div class="post-metadata">

**Author:** ![GogoVega](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gogovega/32/71313_2.png) [@GogoVega](https://discourse.nodered.org/u/GogoVega)\
**Post date:** [14 July 2024 09:57 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/6 "2024-07-14T09:57:04Z")

</div>

> [@XavierTGN](#):
>
> the system deletes all the data in the flows.json file

Is this file empty (completely)?

> [@XavierTGN](#):
>
> If I have port 1880 open to access from the Internet.

Locally in your network or open to internet (outside your network) ?

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 10:01 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/7 "2024-07-14T10:01:11Z")

</div>

> [@XavierTGN](#):
>
> If I have port 1880 open ...

Sorry but that is ambiguous.  
Do you now, or have you ever had port 1880 open to the internet?

---

<div class="post-metadata">

**Author:** ![XavierTGN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/xaviertgn/32/92805_2.png) [@XavierTGN](https://discourse.nodered.org/u/XavierTGN)\
**Post date:** [14 July 2024 10:01 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/8 "2024-07-14T10:01:33Z")

</div>

Yes the file is empty, only .

Yes, I can acces from internet with the address public . Example  
[http://83.56.65.45:1880](http://83.56.65.45:1880).

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 10:06 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/9 "2024-07-14T10:06:38Z")

</div>

You have almost certainly been hacked.

Turn off port forwarding.

Reinstall the entire operating system on the Node-red device.  
Check all of your computers for viruses.  
If you restore Node-red from a backup, check all the flows for nodes you don't recognise, especially exec nodes. Note that these nodes might not be easily visible in the editor desktop.

Search the forum for advice on securing Node-red.  
Password protect your editor.  
Do not use port forwarding!

---

<div class="post-metadata">

**Author:** ![XavierTGN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/xaviertgn/32/92805_2.png) [@XavierTGN](https://discourse.nodered.org/u/XavierTGN)\
**Post date:** [14 July 2024 10:14 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/10 "2024-07-14T10:14:49Z")

</div>

Ok. Now I close the ports and reinstall Debian and node-red,

Thanks for the advice

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 10:30 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/11 "2024-07-14T10:30:28Z")

</div>

Congratulations on possibly being the first person to report Node-red v4 being hacked.

I hope the developers are taking note.

To misquote another forum post on this topic

> V4.x stream is where it ~~will~~  ~~might~~  ~~should be~~ [wasn't] worked on.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [14 July 2024 11:43 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/12 "2024-07-14T11:43:17Z")

</div>

Please remember to change any exposed passwords. Also, check anything else that is on your local network. For example, your router - if an attacker had access to Node-RED, they could easily have made changes to anything that they could access. Especially if you have used default logins for things like routers, the Pi, etc.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [14 July 2024 11:45 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/13 "2024-07-14T11:45:57Z")

</div>

If you have other Raspberry Pies on the network they are probably especially likely to have been impacted,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 August 2024 11:46 UTC](https://discourse.nodered.org/t/the-flows-disappear/89474/14 "2024-08-13T11:46:51Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.