n8n 2.41.5 → 2.44.7
16 releases · 0 breaking changes · 11 security fixes · 11 advisories fixed
11security0breaking0deprecated6feature22fix
Vulnerabilities fixed by this upgrade
- 5.3 GHSA-mgpr-56r4-5c67 OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
- 5.1 GHSA-8vrr-mgc5-jg55 Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
- 5.3 GHSA-crfj-5wv6-8v86 SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
- 5.1 GHSA-8crx-5h96-q72q Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
- 5.1 GHSA-v9cx-v88r-42vw Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
- 5.3 GHSA-43v8-hjhm-chjp Chat Hub: chat-only users can register tool types the product already tries to sandbox
- 5.3 GHSA-65mv-v8rp-54wc Quick Base Node Allows Filter Injection Through the Where Parameter
- 5.3 GHSA-qmvv-q3c9-wpp7 Credential Secrets Exposed in Execution Error Data of Several Nodes
- 7.1 GHSA-m7gv-mpg5-7c9v Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
- 7.2 GHSA-wvjj-qg37-pv73 Crafted Workflow ID Gives Access to Data Tables in Other Projects
- 8.4 GHSA-mp7q-23hg-35cf Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-mp7q-23hg-35cf: Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting in 2.43.5
- security Fixes GHSA-wvjj-qg37-pv73: Crafted Workflow ID Gives Access to Data Tables in Other Projects in 2.43.5
- security Fixes GHSA-m7gv-mpg5-7c9v: Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block in 2.43.5
- security Fixes GHSA-mgpr-56r4-5c67: OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes in 2.43.5
- security Fixes GHSA-crfj-5wv6-8v86: SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data in 2.43.5
- security Fixes GHSA-43v8-hjhm-chjp: Chat Hub: chat-only users can register tool types the product already tries to sandbox in 2.43.5
- security Fixes GHSA-65mv-v8rp-54wc: Quick Base Node Allows Filter Injection Through the Where Parameter in 2.43.5
- security Fixes GHSA-qmvv-q3c9-wpp7: Credential Secrets Exposed in Execution Error Data of Several Nodes in 2.43.5
- security Fixes GHSA-8vrr-mgc5-jg55: Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value in 2.43.5
- security Fixes GHSA-8crx-5h96-q72q: Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard in 2.43.5
- security Fixes GHSA-v9cx-v88r-42vw: Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted in 2.43.5
Every release in between
fixcore: Start sub-workflow error workflow when a pre-run check fails () (67d0e65)
fixEmail Trigger (IMAP) Node: Back off reconnects when the server drops each new connection () (10a9518)
fixMicrosoft SharePoint Node: Fix the column mapper 403 and empty items in Map Automatically () (e67d278)
fixUpdate certifi to 2026.10.19 in task runner () (2858cfb)
fixUpdate certifi to 2026.10.23 in task runner () (6187237)
fixPostgres Node: Prevent global pgtypes overwrite () (654315e)
fixcore: Key queue job outcomes by job on shutdown resume () (1f074d4)
fixeditor: Load credential types on startup () (6ff3198)
fixcore: Reuse connections in the log streaming webhook destination () (b79afe2)
fixcore: Turn off expression spans by default () (6965193)
fixcore: Turn off expression spans by default () (e88162a)
featurecore: Suspend in-flight production executions at worker shutdown () (5863179)
fixcore: Create an XML parser for each webhook request body () (ea3ee53)
securityFixes GHSA-mp7q-23hg-35cf: Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
securityFixes GHSA-wvjj-qg37-pv73: Crafted Workflow ID Gives Access to Data Tables in Other Projects
securityFixes GHSA-m7gv-mpg5-7c9v: Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
securityFixes GHSA-mgpr-56r4-5c67: OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
securityFixes GHSA-crfj-5wv6-8v86: SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
securityFixes GHSA-43v8-hjhm-chjp: Chat Hub: chat-only users can register tool types the product already tries to sandbox
securityFixes GHSA-65mv-v8rp-54wc: Quick Base Node Allows Filter Injection Through the Where Parameter
securityFixes GHSA-qmvv-q3c9-wpp7: Credential Secrets Exposed in Execution Error Data of Several Nodes
securityFixes GHSA-8vrr-mgc5-jg55: Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
securityFixes GHSA-8crx-5h96-q72q: Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
securityFixes GHSA-v9cx-v88r-42vw: Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
fixcore: Validate the size argument of the chunk() expression extension () (4bf0ece)
featureShow Gemini models by name and list prioritized models first in model pickers () (66cece2)
fixcore: Handle each Chat Hub segment once in queue mode () (dc77062)
fixcore: Resume tool calls for deferred tools that a skill loaded () (ea448c6)
fixcore: Keep concurrent credential tests from sharing one node type registry () (c17fdee)
fixcore: Resume tool calls for deferred tools that a skill loaded () (fd2586e)
featurecore: Block create/update of workflows with deprecated nodes () (ff1a24c)
featureGoogle Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list () (8dfc695)
fixeditor: Show the Agent artifact while the builder creates it () (e825e75)
fixAPI: Let global members grant variable scopes to API keys () (d09b8a1)
fixcore: Keep the task runner running on an unhandled promise rejection () (50f2e96)
featureeditor: Show Gateway credits promotions on community nodes () (1ea168e)
fixAPI: Let global members grant variable scopes to API keys () (cc25c71)
featureeditor: Show Gateway credits promotions on community nodes () (a509d92)
fixcore: Keep the task runner running on an unhandled promise rejection () (d719c87)