n8n 2.41.4 → 2.44.6
16 releases · 0 breaking changes · 12 security fixes · 12 advisories fixed
12security0breaking0deprecated6feature17fix
Vulnerabilities fixed by this upgrade
- 5.3 GHSA-mgpr-56r4-5c67 OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
- 5.1 GHSA-8vrr-mgc5-jg55 Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
- 5.3 GHSA-crfj-5wv6-8v86 SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
- 5.1 GHSA-8crx-5h96-q72q Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
- 5.1 GHSA-v9cx-v88r-42vw Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
- 5.1 GHSA-pcr3-v5vr-qppf Per-User Credential Theft via Error-Workflow Execution Context Inheritance
- 5.3 GHSA-43v8-hjhm-chjp Chat Hub: chat-only users can register tool types the product already tries to sandbox
- 5.3 GHSA-65mv-v8rp-54wc Quick Base Node Allows Filter Injection Through the Where Parameter
- 5.3 GHSA-qmvv-q3c9-wpp7 Credential Secrets Exposed in Execution Error Data of Several Nodes
- 7.1 GHSA-m7gv-mpg5-7c9v Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
- 7.2 GHSA-wvjj-qg37-pv73 Crafted Workflow ID Gives Access to Data Tables in Other Projects
- 8.4 GHSA-mp7q-23hg-35cf Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-mp7q-23hg-35cf: Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting in 2.43.5
- security Fixes GHSA-wvjj-qg37-pv73: Crafted Workflow ID Gives Access to Data Tables in Other Projects in 2.43.5
- security Fixes GHSA-m7gv-mpg5-7c9v: Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block in 2.43.5
- security Fixes GHSA-mgpr-56r4-5c67: OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes in 2.43.5
- security Fixes GHSA-crfj-5wv6-8v86: SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data in 2.43.5
- security Fixes GHSA-43v8-hjhm-chjp: Chat Hub: chat-only users can register tool types the product already tries to sandbox in 2.43.5
- security Fixes GHSA-65mv-v8rp-54wc: Quick Base Node Allows Filter Injection Through the Where Parameter in 2.43.5
- security Fixes GHSA-qmvv-q3c9-wpp7: Credential Secrets Exposed in Execution Error Data of Several Nodes in 2.43.5
- security Fixes GHSA-8vrr-mgc5-jg55: Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value in 2.43.5
- security Fixes GHSA-8crx-5h96-q72q: Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard in 2.43.5
- security Fixes GHSA-v9cx-v88r-42vw: Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted in 2.43.5
- security Fixes GHSA-pcr3-v5vr-qppf: Per-User Credential Theft via Error-Workflow Execution Context Inheritance in 2.41.5
Every release in between
fixPostgres Node: Prevent global pgtypes overwrite () (654315e)
fixcore: Key queue job outcomes by job on shutdown resume () (1f074d4)
fixeditor: Load credential types on startup () (6ff3198)
fixcore: Reuse connections in the log streaming webhook destination () (b79afe2)
fixcore: Turn off expression spans by default () (6965193)
fixcore: Turn off expression spans by default () (e88162a)
featurecore: Suspend in-flight production executions at worker shutdown () (5863179)
fixcore: Create an XML parser for each webhook request body () (ea3ee53)
securityFixes GHSA-mp7q-23hg-35cf: Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
securityFixes GHSA-wvjj-qg37-pv73: Crafted Workflow ID Gives Access to Data Tables in Other Projects
securityFixes GHSA-m7gv-mpg5-7c9v: Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
securityFixes GHSA-mgpr-56r4-5c67: OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
securityFixes GHSA-crfj-5wv6-8v86: SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
securityFixes GHSA-43v8-hjhm-chjp: Chat Hub: chat-only users can register tool types the product already tries to sandbox
securityFixes GHSA-65mv-v8rp-54wc: Quick Base Node Allows Filter Injection Through the Where Parameter
securityFixes GHSA-qmvv-q3c9-wpp7: Credential Secrets Exposed in Execution Error Data of Several Nodes
securityFixes GHSA-8vrr-mgc5-jg55: Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
securityFixes GHSA-8crx-5h96-q72q: Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
securityFixes GHSA-v9cx-v88r-42vw: Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
fixcore: Validate the size argument of the chunk() expression extension () (4bf0ece)
featureShow Gemini models by name and list prioritized models first in model pickers () (66cece2)
fixcore: Handle each Chat Hub segment once in queue mode () (dc77062)
fixcore: Resume tool calls for deferred tools that a skill loaded () (ea448c6)
fixcore: Keep concurrent credential tests from sharing one node type registry () (c17fdee)
fixcore: Resume tool calls for deferred tools that a skill loaded () (fd2586e)
featurecore: Block create/update of workflows with deprecated nodes () (ff1a24c)
featureGoogle Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list () (8dfc695)
fixeditor: Show the Agent artifact while the builder creates it () (e825e75)
fixAPI: Let global members grant variable scopes to API keys () (d09b8a1)
fixcore: Keep the task runner running on an unhandled promise rejection () (50f2e96)
featureeditor: Show Gateway credits promotions on community nodes () (1ea168e)
fixAPI: Let global members grant variable scopes to API keys () (cc25c71)
featureeditor: Show Gateway credits promotions on community nodes () (a509d92)
fixcore: Keep the task runner running on an unhandled promise rejection () (d719c87)
securityFixes GHSA-pcr3-v5vr-qppf: Per-User Credential Theft via Error-Workflow Execution Context Inheritance