n8n security update: 12 advisories fixed in 2.45.5 and 3.0.1

n8n published 12 security advisories in its October 28, 2026 security update: three rated High and nine Medium. The fixed versions are 2.45.5 (stable), 2.46.1 (beta), 3.0.1 (3.x beta) and 1.123.89 (1.x). If you self-host n8n on an older version, upgrade to the latest patch of your release line; n8n Cloud instances are patched automatically.

Two of the three High advisories let a user who can create or edit workflows run code on the n8n server, so instances where people you don't fully trust can edit workflows are the most exposed. The third affects workflows that process untrusted images with the Edit Image node.

The short version

• Upgrade to: 2.45.6 (today's stable on npm) or later, 2.46.2 (beta) or later, 3.0.1 or later, or 1.123.89 or later if you're still on 1.x. Each is at or above the fixed version of its line in n8n's update.
• High: the deprecated Function, Function Item and LangChain Code nodes could run code in the n8n main process; the Edit Image node's GraphicsMagick setup could lead to remote code execution with untrusted images; and the expression sandbox could be escaped.
• Medium: issues in Browser Use, the embedded Chat Trigger, the MongoDB, Asana Trigger, Vector Store (OracleDB) and NocoDB nodes, OAuth flows, and nodes that forward credentials on cross-origin redirects.
• No CVE IDs were listed on the advisories when we read them on October 30.
• Deprecated code nodes are now blocked by default: you can't save a workflow that adds or changes a Function, Function Item or LangChain Code node. Existing workflows keep running.

Which version fixes what

n8n's update gives one fixed version per release line. The advisories themselves list the exact ranges, and a few were fixed earlier:

GitHub labels the Medium advisories "Moderate." Several advisories list no 1.x fix; n8n's update only says that 1.x is patched in 1.123.89, so if you're still on 1.x, plan your move to 2.x. Support for 1.x ends on December 31, 2026, per n8n's 3.0 announcement.

The three High advisories

Deprecated code nodes run code in the main process

The Function and Function Item nodes run user code in the vm2 sandbox, and the LangChain Code node runs it directly in the n8n main process. Per the advisory, a user who can create or edit workflows could use them to run arbitrary code outside the task runner isolation that protects the regular Code node. Our task runners guide explains that isolation.

The fix deprecates the three nodes and blocks them by default. In the 2.46.1 source, N8N_DEPRECATED_NODES_BLOCK defaults to true: saving or importing a workflow fails if it adds or changes a deprecated node, while saved workflows that already contain one keep running. Setting it to false turns the block off, which the advisory says restores the vulnerable behavior; the source comment mentions importing older backups as the use case.

What to do: move Function and Function Item logic to the Code node (Run Once for All Items replaces Function, Run Once for Each Item replaces Function Item). n8n 3.0 removes these nodes anyway, as our 3.0 guide covers.

GraphicsMagick in the Edit Image node

The advisory says the GraphicsMagick version in the official n8n Docker image has known vulnerabilities, and that processing untrusted images with the Edit Image node could lead to remote code execution. The riskiest setup it calls out: an unauthenticated Webhook node feeding an Edit Image node.

If you can't upgrade yet, the advisory's short-term mitigations include deactivating such workflows, removing the GraphicsMagick url, svg, mvg, pcd and msl coders from the container, or disabling the node with NODES_EXCLUDE (n8n-nodes-base.editImage).

Expression sandbox escape

Per the advisory, a user who can create or modify workflows could escape the isolation of workflow expressions and run arbitrary code on the n8n host. There's no node to disable here, so the mitigations are about people: restrict the instance to fully trusted users and remove global:member access from anyone who isn't, until you've upgraded.

The Medium advisories in one line each

• Browser Use: the browser_upload tool accepted absolute file paths, so a member could read files the n8n process can read, including configuration files. The advisory says exploitation requires Browser Use to be enabled with N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true. Note that in the 2.46.1 source this variable defaults to true, so set it to false if you don't use Browser Use.
• Chat Trigger in embedded mode: one webhook route skipped the n8n User Auth check, so an unauthenticated request could read a named session's history or start the workflow (advisory).
• MongoDB node: with untrusted input in the update key of Update or Find And Replace, a caller could overwrite or insert other documents (advisory).
• OAuth end-user credentials: affects Enterprise instances with resolvable OAuth2 credentials; a member could get another person's provider tokens stored under their own identity. A short-term fix is N8N_OAUTH_BROWSER_BINDING=true, which defaults to false in the 2.46.1 source (advisory).
• MCP OAuth: the unauthenticated /mcp-oauth/register and /mcp-oauth/authorize endpoints allowed an open redirect; no tokens were leaked, but a victim could be sent to an attacker's site (advisory).
• Asana Trigger: any request with an X-Hook-Secret header could set a new verification secret, letting an attacker who knows the webhook URL send forged events. Fixed since 2.38.0 (advisory).
• Vector Store (OracleDB) node: Metadata Filter keys weren't validated, allowing SQL injection when untrusted input reaches them (advisory).
• Cross-origin redirects: nodes that use credentials forwarded authentication headers when a request redirected to another origin; the HTTP Request node v4.4 already opted out (advisory).
• NocoDB node: with Download Attachments on, the node sent its API token to whatever host an attachment URL named (advisory). Consider rotating NocoDB API tokens used by such workflows.

For the redirect and NocoDB issues, the advisories list N8N_SSRF_PROTECTION_ENABLED=true as a mitigation; it defaults to false in the 2.46.1 source.

What to do now

1. Check your version under Help > About n8n, or with docker compose exec n8n n8n --version.
2. Upgrade to the latest patch of your line. On October 30, npm's stable tag points to 2.45.6 and beta to 2.46.2. Pin the exact version, and give the n8nio/runners image the same tag. Our guide on how to update self-hosted n8n safely has the backup and upgrade steps.
3. Replace Function, Function Item and LangChain Code nodes with the Code node. The block stops you from editing them after the upgrade.
4. Review who can edit workflows. Two of the High advisories need a user who can create or modify workflows. Remove editor access for anyone you don't fully trust, and check for workflows that pass untrusted images from a Webhook node to Edit Image.
5. If you can't upgrade today, apply the advisory mitigations for the features you use, and treat them as temporary: each advisory says they "do not fully remediate the risk."

For what else changed in these versions, see our n8n 2.46 roundup and the 3.0 beta test. n8n posts these updates roughly every two weeks in its community forum's Security Advisories category; we cover each one under the security tag.