high8.2
Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.
Behind the package
View on npmExplore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.
n8n Workflow Automation Tool
Latest release2.45.7
Declared licenseSEE LICENSE IN LICENSE.md
Listed maintainersjan_n8n_io, n8n-matsuuu, cornelius_n8n_io, tomin8n
Runtime dependencies163
Install-time scriptsNone declared
Integrity metadataRecorded by registry
Attestation metadataRecorded, not verified here
Registry deprecationNot marked deprecated
Direct dependencies of 2.45.7
- ai
^7.0.66 - ms
2.1.3 - pg
8.21.0 - ws
8.20.1 - psl
1.15.0 - tar
7.5.21 - zod
3.25.76 - bull
4.16.4 - chat
4.37.0 - cron
4.4.0 - csrf
3.1.0 - jose
^6.2.9 - open
7.4.2 - uuid
11.1.1 - yaml
2.8.3 - isbot
3.6.13 - luxon
3.7.2 - sshpk
1.18.0 - dotenv
17.2.3 - fflate
0.8.3 - helmet
8.1.0 - ldapts
8.1.7 - lodash
4.18.1 - multer
^2.3.0 - nanoid
3.3.18 - semver
7.7.3 - xml2js
0.6.2 - @n8n/db
1.45.6 - @n8n/di
0.17.0 - convict
6.2.5 - express
5.1.0 - flatted
3.4.2 - ioredis
5.3.2 - otpauth
9.1.1 - p-limit
^3.1.0 - samlify
2.13.0 - shelljs
0.8.5 - sqlite3
5.1.7 - sucrase
3.35.0 - bcryptjs
2.4.3 - linkedom
^0.18.13 - n8n-core
2.45.6 - raw-body
3.0.0 - turndown
^7.2.4 - csv-parse
7.0.2 - fast-glob
3.3.3 - file-type
21.3.3 - json-diff
1.0.6 - langsmith
0.6.0 - lru-cache
11.5.1 - pdf-parse
2.4.5 - validator
13.15.26 - @n8n/utils
1.52.1 - formidable
3.5.4 - handlebars
4.7.10 - jsonschema
1.4.1 - nodemailer
10.0.14 - oauth-1.0a
2.2.6 - picocolors
1.0.1 - simple-git
4.0.2 - @n8n/agents
0.30.6 - @n8n/config
2.43.2 - @n8n/engine
0.25.2 - @n8n/errors
0.15.0 - change-case
^5.4.4 - compression
1.8.2 - isolated-vm
^7.0.1 - json-schema
0.4.0 - prom-client
15.1.3 - @n8n/typeorm
0.12.0 - @sentry/node
10.70.0 - jsonwebtoken
9.0.3 - n8n-workflow
2.45.4 - p-cancelable
2.1.1 - posthog-node
5.49.1 - xmllint-wasm
3.0.1 - yargs-parser
21.1.1 - @grpc/grpc-js
^1.14.3 - @n8n/chat-hub
1.38.6 - @n8n/mcp-apps
0.22.7 - cookie-parser
1.4.7 - n8n-editor-ui
2.45.6 - openid-client
6.8.4 - replacestream
4.0.3 - @n8n/api-types
1.45.6 - @n8n/constants
0.43.1 - @n8n/scheduler
1.14.4 - @n8n/telemetry
1.13.6 - n8n-nodes-base
2.45.6 - pkce-challenge
5.0.0 - @azure/identity
4.13.0 - @langchain/core
1.2.8 - @n8n/decorators
1.45.6 - @parcel/watcher
^2.5.1 - class-validator
0.14.0 - fast-json-patch
^3.1.1 - moment-timezone
0.5.48 - @n8n/ai-node-sdk
0.35.6 - @n8n/instance-ai
1.30.6 - @n8n/mcp-browser
0.25.1 - @n8n/permissions
0.82.0 - @n8n/task-runner
2.45.6 - reflect-metadata
0.2.2 - @ai-sdk/anthropic
^4.0.32 - @n8n/ai-utilities
0.38.6 - @n8n/blob-storage
1.13.6 - @n8n/inbound-auth
0.4.4 - @n8n/workflow-sdk
0.38.4 - @resvg/resvg-wasm
2.6.2 - class-transformer
0.5.1 - @1password/connect
1.4.2 - @n8n/client-oauth2
1.27.6 - @n8n/syslog-client
1.12.0 - @opentelemetry/api
1.9.1 - express-handlebars
8.0.1 - express-rate-limit
7.5.0 - source-map-support
0.5.21 - swagger-ui-express
5.0.1 - zod-to-json-schema
3.23.3 - @chat-adapter/slack
4.37.0 - @chat-adapter/teams
4.37.0 - @n8n/backend-common
1.45.6 - @n8n_io/license-sdk
3.3.0 - @opentelemetry/core
2.10.0 - express-prom-bundle
8.0.0 - @chat-adapter/linear
4.37.0 - @iconify-json/lucide
^1.2.112 - @mozilla/readability
^0.6.0 - @n8n/backend-network
1.19.6 - @chat-adapter/discord
4.37.0 - @n8n/backend-services
1.5.6 - @supabase/supabase-js
2.112.3 - http-proxy-middleware
^3.0.7 - @chat-adapter/telegram
4.37.0 - @chat-adapter/whatsapp
4.37.0 - @qdrant/js-client-rest
^1.19.0 - @azure/keyvault-secrets
4.8.0 - @n8n/expression-runtime
0.36.3 - @n8n/ai-workflow-builder
1.45.6 - @n8n/n8n-nodes-langchain
2.45.6 - @n8n_io/ai-assistant-sdk
1.27.0 - @opentelemetry/resources
^2.10.0 - @ai-sdk/openai-compatible
^3.0.44 - @modelcontextprotocol/sdk
1.31.0 - @chat-adapter/state-memory
4.37.0 - @modelcontextprotocol/node
2.0.0 - @joplin/turndown-plugin-gfm
1.0.64 - @pinecone-database/pinecone
^5.0.2 - @google-cloud/secret-manager
5.6.0 - @modelcontextprotocol/server
2.0.0 - @n8n/backend-module-insights
0.3.6 - @rudderstack/rudder-sdk-node
3.0.5 - @opentelemetry/sdk-trace-base
^2.10.0 - @opentelemetry/sdk-trace-node
^2.10.0 - @asteasolutions/zod-to-openapi
7.3.4 - @n8n/node-engine-compatibility
0.13.6 - @aws-sdk/client-secrets-manager
3.808.0 - @n8n/backend-module-quick-connect
0.2.6 - @opentelemetry/context-async-hooks
^2.7.1 - @opentelemetry/semantic-conventions
^1.43.0 - @n8n/backend-module-workflow-builder
0.2.6 - @opentelemetry/exporter-trace-otlp-grpc
^0.221.0 - @opentelemetry/exporter-trace-otlp-proto
^0.221.0
Fetched 31/10/2026, 06:54:29 UTC · Original registry metadata
Release history
Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.
Check the version you ship.
Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.
Advisories & recorded fixes
high8.8
CVE-2026-119408
n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
n8n-io · n8n / n8n-io · n8n
high7.5
CVE-2026-118679
n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
n8n-io · n8n / n8n-io · n8n
high7.1
CVE-2026-118678
n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
n8n-io · n8n / n8n-io · n8n
medium5.9
CVE-2026-118677
n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
n8n-io · n8n / n8n-io · n8n
high7.1
CVE-2026-118676
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
n8n-io · n8n / n8n-io · n8n
high7.1
CVE-2026-118675
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
n8n-io · n8n / n8n-io · n8n
high8.7
CVE-2026-118649
n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
n8n-io · n8n / n8n-io · n8n
high8.4
CVE-2026-118648
n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
n8n-io · n8n / n8n-io · n8n
high8.2
CVE-2026-118647
n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
n8n-io · n8n / n8n-io · n8n
high7.1
CVE-2026-118646
n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
n8n-io · n8n / n8n-io · n8n
high8.7
CVE-2026-118645
n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
n8n-io · n8n / n8n-io · n8n
high7.7
CVE-2026-118644
n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
n8n-io · n8n / n8n-io · n8n
high8.2
CVE-2026-118643
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
n8n-io · n8n / n8n-io · n8n
high7.1
CVE-2026-118642
n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
n8n-io · n8n / n8n-io · n8n
high7.5
CVE-2026-118641
n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
n8n-io · n8n / n8n-io · n8n
medium5.4
CVE-2026-118640
n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
n8n-io · n8n / n8n-io · n8n
high7.7
CVE-2026-110845
n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
n8n-io · n8n
medium5.9
CVE-2026-92588
n8n before 1.123.76 Improper Authorization via Source Control Push
n8n-io · n8n / n8n-io · n8n
medium5.3
medium5.3
medium5.3
CVE-2026-85172
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
n8n-io · n8n / n8n-io · n8n
high7.1
high7.1
CVE-2026-85170
n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
n8n-io · n8n / n8n-io · n8n
high8.7
CVE-2026-85169
n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
n8n-io · n8n / n8n-io · n8n
high7.7
medium6.3
CVE-2026-85167
n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
n8n-io · n8n / n8n-io · n8n
high7.2
CVE-2026-85166
n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
n8n-io · n8n / n8n-io · n8n
high7.2
CVE-2026-85165
n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
n8n-io · n8n / n8n-io · n8n
medium5.8