PT-2026-5931 · N8N · N8N

Published 2026-02-04 · Updated 2026-02-18 · CVE-2025-61917

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions n8n versions 1.65.0 through 1.114.2

Description n8n is a workflow automation platform. The use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. This could result in information disclosure, as uninitialized buffers might contain residual data from the Node.js process, such as prior requests, tasks, secrets, or tokens.

Recommendations Update to version 1.114.3 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Information Disclosure

Weakness Enumeration

CWE-668

CWE-200

Related Identifiers

BDU:2026-02183

CVE-2025-61917

GHSA-49MX-FJ45-Q3P6

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61917.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-49mx-fj45-q3p6 · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/2c4c2953199733c791f739a40879ae31ca129aba · Patch
• https://osv.dev/vulnerability/GHSA-49mx-fj45-q3p6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02183 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61917 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2019110906152775942 · Twitter Post
• https://twitter.com/cracbot/status/2020814996704481699 · Twitter Post
• https://t.me/cveNotify/152379 · Telegram Post