Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who sends crafted requests to the exposed n8n port could crash the service, causing a sustained outage of automation workflows. The most impactful findings are CVE-2026-111181 and CVE-2023-54404, both denial-of-service flaws reachable in normal operation with no special configuration required. The scan also found other exposed issues, but most of them need a non-default option or a workflow that parses untrusted data, so they do not change this verdict; the findings should still be addressed by upgrading the affected packages.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111181 | HIGH7.5 | body-parser 2.3.0 fixed in 2.4.0, 1.20.9 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2023-54404 | HIGH7.5 | zod 3.25.76 fixed in 4.6.6 | — | Directly ExposedContext importance: HIGH |
| CVE-2026-114142 | HIGH7.04 | toml 4.2.0 fixed in 5.0.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-109461 | MEDIUM6 | @azure/msal-node 5.1.5 fixed in 7.1.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-109461 | MEDIUM6 | @azure/msal-node 5.6.0 fixed in 7.1.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111759 | MEDIUM6 | markdown-it 13.0.2 fixed in 15.0.2, 14.3.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-2327 | MEDIUM6 | markdown-it 13.0.2 fixed in 14.1.1 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-114141 | MEDIUM6 | toml 4.2.0 fixed in 5.0.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-114143 | MEDIUM6 | toml 4.2.0 fixed in 5.0.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-114144 | MEDIUM6 | toml 4.2.0 fixed in 5.0.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-85x2-q946-cp5h | MEDIUM5.2 | nodemailer 10.0.14 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM5.2 | nodemailer 10.0.14 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-m943-m63m-w62w | MEDIUM5.2 | nodemailer 10.0.14 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-253c-mchw-3w2r | MEDIUM5.04 | markdown-it 13.0.2 fixed in 15.0.1, 14.3.1 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-71429 | MEDIUM4.96 | stream-json 1.9.1 fixed in 3.5.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-110306 | MEDIUM4.88 | fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59710 | MEDIUM4.88 | showdown 2.1.0 No fix yet | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59711 | MEDIUM4.88 | showdown 2.1.0 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-48988 | MEDIUM4.24 | markdown-it 13.0.2 fixed in 14.2.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-113650 | MEDIUM4.24 | sanitize-html 2.18.0 fixed in 2.18.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-104183 | MEDIUM4.08 | stream-json 1.9.1 fixed in 3.6.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-110180 | LOW3.84 | fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-104182 | LOW3.72 | stream-json 1.9.1 fixed in 3.6.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-1899 | LOW3.6 | showdown 2.1.0 No fix yet | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-57665 | LOW3.37 | element-plus 2.4.3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-111997 | LOW3.18 | ip-address 10.7.1 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-110095 | LOW2.96 | fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-110725 | LOW2.96 | fast-uri 3.1.8 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111766 | LOW2.96 | markdown-it 13.0.2 fixed in 14.3.3, 15.0.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
Want to check another image? Run a full scan with the Docker Security Scanner.