kadet-hub
Image security report: n8n recipe
n8n: grade F, 129 findings, one per advisory and package, in the 1 image of version 1.0.1: CRITICAL 1, HIGH 43, MEDIUM 56, LOW 29, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/n8nio/n8n:2.45.5@sha256:9f6d0a5987ab5a297c4b0b38fbf1a22285dd1364551478e93f03d506908fa74c
CRITICAL 1, HIGH 43, MEDIUM 56, LOW 29, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-111497 | CRITICAL | brotli-libs | 1.2.0-r1 | 1.2.1-r0 |
| CVE-2026-109383 | HIGH | undici | 6.29.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109383 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109461 | HIGH | @azure/msal-node | 5.1.5 | 7.1.0 |
| CVE-2026-109461 | HIGH | @azure/msal-node | 5.6.0 | 7.1.0 |
| CVE-2026-109829 | HIGH | undici | 7.29.1 | 7.30.1, 8.12.2 |
| CVE-2026-109869 | HIGH | undici | 6.29.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109869 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-111181 | HIGH | body-parser | 2.3.0 | 2.4.0, 1.20.9 |
| CVE-2026-111755 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-111755 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-111756 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-111756 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-111759 | HIGH | markdown-it | 13.0.2 | 15.0.2, 14.3.2 |
| CVE-2026-111767 | HIGH | @modelcontextprotocol/sdk | 1.31.0 | 1.32.0 |
| CVE-2026-111768 | HIGH | @modelcontextprotocol/sdk | 1.31.0 | 1.32.0 |
| CVE-2026-111768 | HIGH | @modelcontextprotocol/server | 2.0.0 | 2.3.0 |
| CVE-2026-111770 | HIGH | @modelcontextprotocol/server | 2.0.0 | 2.3.0 |
| CVE-2026-113351 | HIGH | libexpat | 2.9.0-r1 | 2.10.0-r0 |
| CVE-2026-113872 | HIGH | multer | 2.3.0 | 2.5.0 |
| CVE-2026-114141 | HIGH | toml | 4.2.0 | 5.0.1 |
| CVE-2026-114142 | HIGH | toml | 4.2.0 | 5.0.1 |
| CVE-2026-114143 | HIGH | toml | 4.2.0 | 5.0.1 |
| CVE-2026-114144 | HIGH | toml | 4.2.0 | 5.0.1 |
| CVE-2026-115506 | HIGH | libexpat | 2.9.0-r1 | 2.10.0-r0 |
| CVE-2026-116689 | HIGH | follow-redirects | 1.16.0 | 1.16.2 |
| CVE-2026-116689 | HIGH | follow-redirects | 1.16.0 | 1.16.2 |
| CVE-2026-117610 | HIGH | libexpat | 2.9.0-r1 | 2.10.0-r0 |
| CVE-2026-118257 | HIGH | @intlify/core-base | 11.4.5 | 11.4.14, 12.0.0-alpha.5 |
| CVE-2026-118257 | HIGH | @intlify/shared | 11.4.5 | 11.4.14, 12.0.0-alpha.5 |
| CVE-2026-118257 | HIGH | vue-i18n | 11.4.5 | 11.4.14, 12.0.0-alpha.5 |
| CVE-2026-118370 | HIGH | libexpat | 2.9.0-r1 | 2.10.0-r0 |
| CVE-2026-123158 | HIGH | openssh | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-client-common | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-client-default | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-keygen | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-server | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-server-common | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-sftp-server | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-87018 | HIGH | undici | 6.29.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-87018 | HIGH | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-92392 | HIGH | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| GHSA-f897-62hf-6gxq | HIGH | @modelcontextprotocol/node | 2.0.0 | 2.1.0 |
| GHSA-f897-62hf-6gxq | HIGH | @modelcontextprotocol/server | 2.0.0 | 2.1.0 |
| CVE-2024-1899 | MEDIUM | showdown | 2.1.0 | |
| CVE-2025-57665 | MEDIUM | element-plus | 2.4.3 | |
| CVE-2026-101910 | MEDIUM | ip-address | 10.3.1 | 10.5.1 |
| CVE-2026-101911 | MEDIUM | ip-address | 10.3.1 | 10.7.1 |
| CVE-2026-101912 | MEDIUM | ip-address | 10.3.1 | 10.7.1 |
| CVE-2026-101913 | MEDIUM | ip-address | 10.3.1 | 10.5.1 |
| CVE-2026-104182 | MEDIUM | stream-json | 1.9.1 | 3.6.0 |
| CVE-2026-104183 | MEDIUM | stream-json | 1.9.1 | 3.6.0 |
| CVE-2026-106119 | MEDIUM | @langchain/mongodb | 1.0.1 | 1.3.1 |
| CVE-2026-109841 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 |
| CVE-2026-109924 | MEDIUM | undici | 6.29.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109924 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109932 | MEDIUM | undici | 6.29.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109932 | MEDIUM | undici | 7.29.1 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-110180 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110306 | MEDIUM | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110816 | MEDIUM | qs | 6.15.2 | 6.16.1 |
| CVE-2026-111757 | MEDIUM | hono | 4.12.34 | 4.13.11 |
| CVE-2026-111769 | MEDIUM | @modelcontextprotocol/sdk | 1.31.0 | 1.32.0 |
| CVE-2026-111771 | MEDIUM | @modelcontextprotocol/sdk | 1.31.0 | 1.32.0 |
| CVE-2026-111771 | MEDIUM | @modelcontextprotocol/server | 2.0.0 | 2.3.0 |
| CVE-2026-111997 | MEDIUM | ip-address | 10.3.1 | 10.7.4 |
| CVE-2026-113654 | MEDIUM | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-113661 | MEDIUM | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-118663 | MEDIUM | @hono/node-server | 1.19.15 | 2.1.3 |
| CVE-2026-118764 | MEDIUM | minimatch | 10.2.3 | 11.0.1 |
| CVE-2026-118764 | MEDIUM | minimatch | 9.0.9 | 11.0.1 |
| CVE-2026-118773 | MEDIUM | glob | 10.5.0 | 14.0.2 |
| CVE-2026-118773 | MEDIUM | glob | 11.1.0 | 14.0.2 |
| CVE-2026-17495 | MEDIUM | moment | 2.30.1 | 2.31.0 |
| CVE-2026-2327 | MEDIUM | markdown-it | 13.0.2 | 14.1.1 |
| CVE-2026-45382 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-45383 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r1 | 1.4-r0 |
| CVE-2026-48988 | MEDIUM | markdown-it | 13.0.2 | 14.2.0 |
| CVE-2026-49295 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-49337 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-49346 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-54240 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-54241 | MEDIUM | libde265 | 1.1.1-r0 | 1.1.3-r0 |
| CVE-2026-59710 | MEDIUM | showdown | 2.1.0 | |
| CVE-2026-59711 | MEDIUM | showdown | 2.1.0 | |
| CVE-2026-71429 | MEDIUM | stream-json | 1.9.1 | 3.5.0 |
| CVE-2026-82417 | MEDIUM | qs | 6.15.2 | 6.16.0 |
| CVE-2026-82562 | MEDIUM | qs | 6.15.2 | 6.16.0 |
| CVE-2026-84363 | MEDIUM | hono | 4.12.34 | 4.13.5 |
| CVE-2026-84364 | MEDIUM | hono | 4.12.34 | 4.13.5 |
| CVE-2026-84365 | MEDIUM | hono | 4.12.34 | 4.13.5 |
| CVE-2026-87029 | MEDIUM | undici | 7.29.1 | 7.30.1, 8.12.2 |
| CVE-2026-88932 | MEDIUM | multer | 2.3.0 | 2.4.0 |
| CVE-2026-92388 | MEDIUM | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-93981 | MEDIUM | hono | 4.12.34 | 4.13.7 |
| GHSA-253c-mchw-3w2r | MEDIUM | markdown-it | 13.0.2 | 15.0.1, 14.3.1 |
| GHSA-85x2-q946-cp5h | MEDIUM | nodemailer | 10.0.14 | 10.1.4 |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM | nodemailer | 10.0.14 | 10.1.4 |
| GHSA-m943-m63m-w62w | MEDIUM | nodemailer | 10.0.14 | 10.1.4 |
| CVE-2026-105799 | LOW | @langchain/redis | 1.0.1 | 1.1.1 |
| CVE-2026-107928 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-107929 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-110095 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110725 | LOW | fast-uri | 3.1.8 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-111766 | LOW | markdown-it | 13.0.2 | 14.3.3, 15.0.3 |
| CVE-2026-113657 | LOW | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-118256 | LOW | @intlify/core-base | 11.4.5 | 11.4.14, 12.0.0-alpha.5 |
| CVE-2026-118256 | LOW | vue-i18n | 11.4.5 | 11.4.14, 12.0.0-alpha.5 |
| CVE-2026-86409 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86410 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86411 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86412 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86413 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86414 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86415 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87861 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87862 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87863 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87864 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87865 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87866 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92386 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92387 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92389 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92390 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92391 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94265 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94266 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |