n8n 2.44.5 → 2.45.5
4 releases · 0 breaking changes · 9 security fixes · 9 advisories fixed
9security0breaking0deprecated4feature22fix
Vulnerabilities fixed by this upgrade
- 6.3 GHSA-jmcg-c7p5-q69g NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments
- 6.3 GHSA-prmc-fg87-r4gh Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects
- 5.1 GHSA-rc3w-8jc8-7x3w Open Redirect via MCP OAuth Dynamic Client Registration
- 4.8 GHSA-426f-xmcv-g8pg OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback
- 5.3 GHSA-4v22-g448-h4rg MongoDB Node Update Operations Can Modify Unintended Documents
- 6.3 GHSA-pwj5-wwm6-g83j Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests
- 6.0 GHSA-9qx8-fhxv-w794 Browser Use Upload Tool Reads Arbitrary Files from the n8n Server
- 7.7 GHSA-gx3v-3x3v-f8r5 Insufficient Isolation in Workflow Expression Evaluation
- 7.7 GHSA-f2cw-9483-7vcp Insecure GraphicsMagick Configuration
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-gx3v-3x3v-f8r5: Insufficient Isolation in Workflow Expression Evaluation in 2.45.5
- security Fixes GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration in 2.45.5
- security Fixes GHSA-jmcg-c7p5-q69g: NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments in 2.45.5
- security Fixes GHSA-prmc-fg87-r4gh: Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects in 2.45.5
- security Fixes GHSA-pwj5-wwm6-g83j: Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests in 2.45.5
- security Fixes GHSA-9qx8-fhxv-w794: Browser Use Upload Tool Reads Arbitrary Files from the n8n Server in 2.45.5
- security Fixes GHSA-4v22-g448-h4rg: MongoDB Node Update Operations Can Modify Unintended Documents in 2.45.5
- security Fixes GHSA-rc3w-8jc8-7x3w: Open Redirect via MCP OAuth Dynamic Client Registration in 2.45.5
- security Fixes GHSA-426f-xmcv-g8pg: OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback in 2.45.5
Every release in between
securityFixes GHSA-gx3v-3x3v-f8r5: Insufficient Isolation in Workflow Expression Evaluation
securityFixes GHSA-f2cw-9483-7vcp: Insecure GraphicsMagick Configuration
securityFixes GHSA-jmcg-c7p5-q69g: NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments
securityFixes GHSA-prmc-fg87-r4gh: Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects
securityFixes GHSA-pwj5-wwm6-g83j: Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests
securityFixes GHSA-9qx8-fhxv-w794: Browser Use Upload Tool Reads Arbitrary Files from the n8n Server
securityFixes GHSA-4v22-g448-h4rg: MongoDB Node Update Operations Can Modify Unintended Documents
securityFixes GHSA-rc3w-8jc8-7x3w: Open Redirect via MCP OAuth Dynamic Client Registration
securityFixes GHSA-426f-xmcv-g8pg: OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback
fixcore: Keep the ExpressionError name in minified builds () (b3192c6)
fixcore: Keep undefined values in QuickJS expression results () (532f645)
fixeditor: Align carets within split buttons () (61cbfea)
fixeditor: Improve first load speed () (8b6bdbb)
fixeditor: Match Evals Run Test button colors () (f594853)
fixeditor: Remove underlines from breadcrumb links () (127d65a)
fixeditor: Remove underlines from Data Table links () (619271c)
fixeditor: Stop Safari from opening its own context menu on the canvas () (28f9c9e)
featurecore: Make custom OTel attribute key prefixes configurable () (6071b12)
fixcore: Recreate removed n8n-sandbox sandboxes and rerun workspace setup () (11e279a)
fixcore: Start sub-workflow error workflow when a pre-run check fails () (9595142)
fixeditor: Match navigation plus button hover styling () (471c006)
fixeditor: Point migration report docs link to the v3 breaking changes page () (b617384)
fixEmail Trigger (IMAP) Node: Back off reconnects when the server drops each new connection () (618064c)
fixMicrosoft SharePoint Node: Fix the column mapper 403 and empty items in Map Automatically () (79bbff4)
fixUpdate certifi to 2026.10.19 in task runner () (d53bba1)
fixUpdate certifi to 2026.10.23 in task runner () (82788cc)
featureeditor: Filter migration report workflows by project () (2946963)
featureeditor: Refactor N8nBreadcrumbs and callers () (81d4309)
featureImplements new taxonomy experiment for sales-and-marketing responders () (24e1504)
fixcore: Start sub-workflow error workflow when a pre-run check fails () (67d0e65)
fixEmail Trigger (IMAP) Node: Back off reconnects when the server drops each new connection () (10a9518)
fixMicrosoft SharePoint Node: Fix the column mapper 403 and empty items in Map Automatically () (e67d278)
fixUpdate certifi to 2026.10.19 in task runner () (2858cfb)
fixUpdate certifi to 2026.10.23 in task runner () (6187237)
fixPostgres Node: Prevent global pgtypes overwrite () (654315e)