EUVD-2026-56145

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766

n8n contains a type confusion in the Send Email node that can read arbitrary local files and trigger SSRF. Affected versions: n8n before 1.123.67, n8n 2.x before 2.31.5, and n8n 2.32.x before 2.32.1. The issue arises when non‑string values are fed into the node’s text or HTML body and interpreted...

GHSA-2X35-3FW4-9JR4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host. Exploitation...