Self-hosted n8n before 2.41.4: 26 September advisories with no CVE ID, and npm audit won't show them
Description and use
Updating to the patched releases and tightening network exposure mitigates the September 2026 advisories that were invisible to standard scanners.
Problem
Self‑hosted n8n instances may be vulnerable to recent security advisories that are not detected by common dependency scanners.
Outcome
Updating to the patched releases and tightening network exposure mitigates the September 2026 advisories that were invisible to standard scanners.
Workflow
- 1. Verify current n8n version via editor Help > About n8n or command line n8n --version (or docker exec
<container>n8n --version). - 2. Check the version against the free checker at https://munimv2.github.io/n8n.html to see which advisory batches apply.
- 3. If vulnerable, update n8n to the appropriate patched release (2.41.4+ stable, 2.42.1+ beta, or 1.123.83+ 1.x).
- 4. Ensure n8n listens only on required interfaces (e.g., bind to 127.0.0.1 or use a reverse proxy with TLS).
- 5. If the instance was exposed to the internet, review users, OAuth clients, API keys, and rotate credentials, especially those with high privileges.
- 6. For very old instances (<1.121.0), also consider the Ni8mare vulnerability (CVE‑2026‑21858).
Evidence
n8n published three batches of security advisories in September 2026. The first one (10 September) got CVE IDs and is in the public databases. The other two have no CVE IDs:
Short version: update to 2.41.4 or newer on the stable line (the current latest on npm is 2.42.6), 2.42.1 or newer on beta, or 1.123.83 or newer if you're still on 1.x.
From the 30 September batch: GHSA-3qcw-p65v-c7vq (CVSS 8.2, no login needed): OAuth clients can be stored through the authorize endpoint without authentication.
To check a whole machine, the free, read-only, MIT-licensed local-ai-checkup script finds n8n on port 5678 or from a running n8nio/n8n image tag and compares the version against the same data.
- Record date: 2026-10-12T02:41:15.042Z