VulnerabilityAnalyzed

CVE-2025-61917

From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory.

HIGH 7.7EPSS 0.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the same Node.js process (for example, data from prior requests, tasks, secrets, or tokens), resulting in potential information disclosure. This issue has been patched in version 1.114.3.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.37% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-200, CWE-668
Affected: n8n/n8n
Source: security-advisories@github.com

References

https://github.com/n8n-io/n8n/commit/2c4c2953199733c791f739a40879ae31ca129abaPatch
https://github.com/n8n-io/n8n/security/advisories/GHSA-49mx-fj45-q3p6Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.