CLEANSTART-2026-BZ85863 fast-uri is a URI parser for Node

Security vulnerability affects the n8n package. fast-uri is a URI parser for Node...

CLEANSTART-2026-EM16242 Security fix for GHSA-v836-6xw4-9cx3 applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GB44071 toml-node is a TOML parser for Node

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

CLEANSTART-2026-EQ29985 Security fix for GHSA-m5w8-4gq2-6f8x applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SV74760 vm2 is an open source vm/sandbox for Node

Security vulnerability affects the n8n package. vm2 is an open source vm/sandbox for Node...

CLEANSTART-2026-MK88618 vm2 is an open source vm/sandbox for Node

Security vulnerability affects the n8n package. vm2 is an open source vm/sandbox for Node...

CLEANSTART-2026-WV02485 SheetJS Community Edition before 0

Security vulnerability affects the n8n package. SheetJS Community Edition before 0...

CLEANSTART-2026-WB52901 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CLEANSTART-2026-VK51150 SheetJS Community Edition before 0

Security vulnerability affects the n8n package. SheetJS Community Edition before 0...

CLEANSTART-2026-PD83197 vm2 is an open source vm/sandbox for Node

Security vulnerability affects the n8n package. vm2 is an open source vm/sandbox for Node...

CLEANSTART-2026-TL42570 LangChain is a framework for building LLM-powered applications

Security vulnerability affects the n8n package. LangChain is a framework for building LLM-powered applications...

CLEANSTART-2026-PG50954 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node

Security vulnerability affects the n8n package. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node...

CLEANSTART-2026-PK15344 undici's dump interceptor reads and discards a response body up to a configurable maximum size

Security vulnerability affects the n8n package. undici's dump interceptor reads and discards a response body up to a configurable maximum size...

CLEANSTART-2026-HE03730 Security fix for CVE-2026-101899 applied in: n8n 2.28.0-r5

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RO21037 adm-zip 0

Security vulnerability affects the n8n package. adm-zip 0...

CLEANSTART-2026-FA02454 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Security vulnerability affects the n8n package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers...

CLEANSTART-2026-AK31970 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-EJ44011 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-RX62233 n8n before versions 1

Security vulnerability affects the n8n package. n8n before versions 1...

CLEANSTART-2026-EY43769 n8n is an open source workflow automation platform

Security vulnerability affects the n8n package. n8n is an open source workflow automation platform...

CLEANSTART-2026-AM75023 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-FF64850 vm2 versions 3

Security vulnerability affects the n8n package. vm2 versions 3...

CLEANSTART-2026-OK91929 n8n before 1

Security vulnerability affects the n8n package. n8n before 1...

CLEANSTART-2026-JB83386 issue in the anchors subparser of Showdownjs versions <= 2

Security vulnerability affects the n8n package. An issue in the anchors subparser of Showdownjs versions = 2...

CLEANSTART-2026-ME44446 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-EI20913 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-DH24226 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-WF83239 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

Security vulnerability affects the n8n package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

CLEANSTART-2026-LD08351 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-TC48038 undici's retry handler can leave an already-exposed response body pending forever

Security vulnerability affects the n8n package. undici's retry handler can leave an already-exposed response body pending forever...

CLEANSTART-2026-YE85588 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-RI78049 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-PF49108 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CLEANSTART-2026-XX88554 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the n8n package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-YP03178 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients

Security vulnerability affects the n8n package. MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients...

CLEANSTART-2026-GY66727 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-XM40960 source-map-js through 1

Security vulnerability affects the n8n package. source-map-js through 1...

CLEANSTART-2026-NW59301 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the n8n package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-UD09279 http-cache-semantics through 4

Security vulnerability affects the n8n package. http-cache-semantics through 4...

CLEANSTART-2026-WT34864 compression is a Node

Security vulnerability affects the n8n package. compression is a Node...

CLEANSTART-2026-XE55341 braces through 3

Security vulnerability affects the n8n package. braces through 3...

CLEANSTART-2026-KF40182 undici's WebSocket client crashes the whole Node

Security vulnerability affects the n8n package. undici's WebSocket client crashes the whole Node...

CLEANSTART-2026-DA12179 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the n8n package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-LR06442 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the n8n package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-VG90547 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...

CLEANSTART-2026-XJ45265 vm2 versions 3

Security vulnerability affects the n8n package. vm2 versions 3...

CLEANSTART-2026-YW49143 vm2 through 3

Security vulnerability affects the n8n package. vm2 through 3...

CLEANSTART-2026-LI48838 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CLEANSTART-2026-HO68117 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CLEANSTART-2026-PO58862 simple-git, an interface for running git commands in any node

Security vulnerability affects the n8n package. simple-git, an interface for running git commands in any node...