Vulnerability Reportn8nio/n8n:2.47.4

n8nio/n8n:latestn8nio/n8n:stablen8nio/n8n:2.47.4-ec12419n8nio/n8n:2.47.4

digestsha256:56a3f0d56c2888b53ca7d89de4aa3de702888f33667c96a1f1d7118548f979e9

Executive Summary

Last scanned: Nov 11, 2026

Threat ScoreCAUTION• CVE-2026-111181 in body-parser (2.3.0) is the top concern: it is reachable over the network on the inbound HTTP port in normal operation, and one crafted compressed request can crash the n8n process.• CVE-2023-54404 in zod (3.25.76) is also reachable by default; a large array in a request body can exhaust memory and crash the process.• The scan found 32 exposed findings in total, 3 of them at severity 7.0 or above and 12 at 6.0 or above, with a maximum severity of 7.5.• None of the exposed findings are listed as known to be actively exploited, and no post-exploit-only findings were reported.• Most of the remaining exposed findings (for example CVE-2026-114142 in toml and CVE-2026-109461 in @azure/msal-node) only matter when a non-default workflow or node is used, which lowers their practical relevance here.• The publisher reputation verdict is TRUSTED, with the image pinned by digest, which supports provenance but does not remove the flaws listed above.

58/100CAUTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who sends a single crafted compressed request, or a request with a very large array, could crash the n8n process and cause a service outage or memory exhaustion on an internet-reachable service. The most serious of these is CVE-2026-111181 in body-parser, and the request-validation flaw CVE-2023-54404 in zod carries similar availability impact. Upgrading the affected packages to fixed versions is the practical path to reduce this exposure before production use.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

32 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-111181	HIGH7.5	body-parser 2.3.0 fixed in 2.4.0, 1.20.9	0.4% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2023-54404	HIGH7.5	zod 3.25.76 fixed in 4.6.6	—	Directly ExposedContext importance: HIGH
CVE-2026-114142	HIGH7.04	toml 4.2.0 fixed in 5.0.1	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-109461	MEDIUM6	@azure/msal-node 5.1.5 fixed in 7.1.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-109461	MEDIUM6	@azure/msal-node 5.6.0 fixed in 7.1.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-111759	MEDIUM6	markdown-it 13.0.2 fixed in 15.0.2, 14.3.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-2327	MEDIUM6	markdown-it 13.0.2 fixed in 14.1.1	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-113872	MEDIUM6	multer 2.4.0 fixed in 2.5.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-114141	MEDIUM6	toml 4.2.0 fixed in 5.0.1	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-114143	MEDIUM6	toml 4.2.0 fixed in 5.0.1	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-114144	MEDIUM6	toml 4.2.0 fixed in 5.0.1	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-109869	MEDIUM6	undici 6.29.0 fixed in 6.29.1, 7.30.1, 8.12.2	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
GHSA-85x2-q946-cp5h	MEDIUM5.2	nodemailer 10.0.14 fixed in 10.1.4	—	Directly ExposedContext importance: MEDIUM
GHSA-8c8m-p3m8-cjg8	MEDIUM5.2	nodemailer 10.0.14 fixed in 10.1.4	—	Directly ExposedContext importance: MEDIUM
GHSA-m943-m63m-w62w	MEDIUM5.2	nodemailer 10.0.14 fixed in 10.1.4	—	Directly ExposedContext importance: MEDIUM
GHSA-253c-mchw-3w2r	MEDIUM5.04	markdown-it 13.0.2 fixed in 15.0.1, 14.3.1	—	Directly ExposedContext importance: MEDIUM
CVE-2026-71429	MEDIUM4.96	stream-json 1.9.1 fixed in 3.5.0	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-110306	MEDIUM4.88	fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59710	MEDIUM4.88	showdown 2.1.0 No fix yet	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-59711	MEDIUM4.88	showdown 2.1.0 No fix yet	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-109924	MEDIUM4.5	undici 6.29.0 fixed in 6.29.1, 7.30.1, 8.12.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-48988	MEDIUM4.24	markdown-it 13.0.2 fixed in 14.2.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-113650	MEDIUM4.24	sanitize-html 2.18.0 fixed in 2.18.1	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-104183	MEDIUM4.08	stream-json 1.9.1 fixed in 3.6.0	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-110180	LOW3.84	fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-104182	LOW3.72	stream-json 1.9.1 fixed in 3.6.0	0.2% Theoretical Threat	Directly Exposed
CVE-2024-1899	LOW3.6	showdown 2.1.0 No fix yet	0.8% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2025-57665	LOW3.37	element-plus 2.4.3 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-111997	LOW3.18	ip-address 10.7.1 fixed in 10.7.4	0.3% Theoretical Threat	Directly Exposed
CVE-2026-110095	LOW2.96	fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-110725	LOW2.96	fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-111766	LOW2.96	markdown-it 13.0.2 fixed in 14.3.3, 15.0.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM

Want to check another image? Run a full scan with the Docker Security Scanner.