Uninitialized Memory Exposure in n8n Workflow Automation Platform
CVE-2025-61917

7.7HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
4 February 2026

What is CVE-2025-61917?

A vulnerability in the n8n workflow automation platform allows untrusted code to allocate uninitialized memory due to the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner. This could potentially expose sensitive data, including prior requests, tasks, secrets, or tokens retained in memory, leading to information disclosure. Users are advised to update to version 1.114.3 or later to mitigate this issue.

Affected Version(s)

n8n >= 1.65.0, < 1.114.3

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-49...
x_refsource_CONFIRM
https://github.com/n8n-io/n8n/commit/2c4c2953199733c791f7...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.