VulertSecurity VulertSecurity

Vulnerability Database · npm · n8n · Version

n8n 2.43.5

2.43.5 is affected by 18 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 0 High 7 Medium 11 Low 0 Unrated 0

All n8n versions & vulnerabilities → Source repository Search the database for this package →
Released 14 Oct 2026 Licence non-standard Also known from other sources 0 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

n8n 2.43.5 vulnerabilities

18 vulnerabilities cover n8n 2.43.5. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
SQL Injection Vulnerability in n8n MySQL v1 Node - Moderate Risk 8.8 medium No fix published 08 Jul 2026
External Secrets Permission Bypass in n8n: A Security Concern 6.5 medium No fix published 15 Jul 2026
Improper Authorization in n8n Allows Workflow Assignment Across Projects 5.0 medium No fix published 08 Jul 2026
Disk Space Exhaustion Vulnerability in n8n Package 4.3 medium No fix published 10 Jul 2026
DOM-Based XSS Vulnerability in n8n: Unsandboxed iframe srcdoc Issue N/A high No fix published 22 Jul 2026
Race Condition Vulnerability in n8n Git Clone Node Allows Remote Code Execution N/A high No fix published 22 Jul 2026
Exposed Google Service Account Private Key in n8n Package - Vulnerability Summary N/A medium No fix published 22 Jul 2026
Privilege Escalation and Code Execution Vulnerability in n8n N/A high No fix published 22 Jul 2026
Privilege Escalation Vulnerability in n8n: AI Agents Project Viewer Exploit N/A high No fix published 22 Jul 2026
Privilege Escalation Vulnerability in n8n: SSO Instance-Role Provisioning N/A high No fix published 22 Jul 2026
Legacy Expression Evaluator Sanitizer Bypass in n8n Leads to Authenticated Code Execution N/A high No fix published 22 Jul 2026
Unauthenticated Endpoint Vulnerability in n8n: Risk of Test Webhook Cancellation N/A medium No fix published 22 Jul 2026
Stored DOM XSS Vulnerability in n8n Package - GHSA-h5xr-fqvj-253p N/A high No fix published 22 Jul 2026
Sensitive Data Exposure in n8n: Custom Header Credential Values Leaked in Plaintext N/A medium No fix published 22 Jul 2026
Security Flaw in n8n: GraphQL Node Bypasses Allowed HTTP Request Domains Restriction N/A medium No fix published 22 Jul 2026
OAuth Authorization Bypass in n8n: Member-Level Users Can Execute Other Users' Workflows N/A medium No fix published 22 Jul 2026
Authenticated SSRF Vulnerability in n8n: Internal Network Access Risk N/A medium No fix published 22 Jul 2026
Information Disclosure Vulnerability in n8n: External Secrets Accessible via Workflow Expressions N/A medium No fix published 15 Jul 2026

Looking for another version, or everything Vulert holds for n8n?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About n8n 2.43.5

Is n8n 2.43.5 vulnerable?

Yes. 18 vulnerabilities in the Vulert database cover n8n 2.43.5: 0 critical, 7 high, 11 medium and 0 low. Each entry above names the fixed version to move to.

Is 2.43.5 the latest release of n8n?

No. 2.43.5 was published 14 Oct 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor n8n for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the n8n version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.