CVE-2025-61917: n8n Buffer Allocation Flaw Leads to Memory Disclosure
Summary
CVE-2025-61917: n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner. Affects n8n versions >= 1.65.0, < 1.114.3. Fixed in 1.114.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services through customizable workflows. It supports a wide range of integrations and enables users to automate repetitive tasks without extensive coding knowledge. However, the use of unsafe buffer allocation methods in its task runner poses a significant security risk, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in n8n's task runner, which allows untrusted code to allocate uninitialized memory. This uninitialized memory can contain residual data from previous operations within the same Node.js process, leading to potential information disclosure of sensitive data such as secrets, tokens, or user data. Only authenticated users can execute code through Task Runners, but the risk remains significant if the conditions for exploitation are met.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.114.3
This is the first release that contains the fix.
npm install n8n@1.114.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider the following workarounds: 1. Disable the Code Node by adding 'n8n-nodes-base.code' to the 'NODES_EXCLUDE' environment variable. 2. Run Task Runners in external mode to isolate untrusted task code in a separate sidecar container, significantly reducing the risk of memory disclosure. Refer to the n8n documentation for configuration details.
Conclusion
The CVE-2025-61917 vulnerability in n8n highlights the importance of safe memory allocation practices in software development. By upgrading to the patched version and implementing recommended workarounds, users can significantly reduce the risk of sensitive data exposure.
See every vulnerability recorded for n8n →
FAQ
CVE-2025-61917 is a vulnerability in n8n that allows untrusted code to allocate uninitialized memory, potentially leading to information disclosure.
Authenticated users can execute code that may inadvertently expose sensitive data from uninitialized buffers, posing a security risk.
Versions of n8n from 1.65.0 up to but not including 1.114.3 are affected by this vulnerability.
You can disable the Code Node or run Task Runners in external mode as temporary workarounds to mitigate the risk.
You can refer to the n8n documentation and the Node.js documentation for more details on buffer allocation practices.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
