2420 matches found
CVE-2026-77085
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
CVE-2026-77069
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...
CVE-2026-77076
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...
CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
CVE-2026-77076 n8n before 1.123.69 Credential Leak via GraphQL Node Error
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...
EUVD-2026-63265
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...
PT-2026-78940
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 n8n versions 2.33.x prior to 2.33.4 Description The SearXNG Agent tool contains a Server-Side Request Forgery SSRF protection bypass. This occurs because the tool utilizes a raw HTTP client to send requests to a...
PT-2026-80244
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter " " appears. A remote MCP serve...
BIT-NODE-MIN-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
BIT-NODE-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
K000162941: NodeJS vulnerability CVE-2026-58044
Security Advisory Description A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers...
PT-2026-73412
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
PT-2026-73402
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
EUVD-2026-58137
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
CVE-2026-54481
The Gitea Git repository management system contains a flaw where the internal API HTTP client hardcodes InsecureSkipVerify:true in the init-function of the internalAPITransport function (located in modules/private/internal.go). This lack of TLS certificate verification allows a remote attacker on...
Alibaba Cloud Linux 3 : 0255: resource-agents (ALINUX3-SA-2026:0255)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0255 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library f...
