Which versions of Node.js are affected by CVE-2026-27496?

n8n workflow automation deployments with Task Runners enabled face a risk of sensitive data exposure, including secrets and authentication tokens, through memory buffer access by authorized users.. A patch is available.

How to fix or mitigate CVE-2026-27496?

Within 24 hours: Inventory all n8n deployments with Task Runners enabled and identify users with workflow creation/modification permissions; assess whether production workflows contain sensitive credentials. Within 7 days: Disable Task Runner functionality if not operationally critical, or implement strict access controls limiting workflow modification to essential personnel only; review audit logs for suspicious workflow modifications. Within 30 days: Monitor vendor advisories for patch availability; evaluate migration to alternative automation platforms or hardened n8n configurations; conduct credential rotation for any systems accessed by identified n8n instances.

Node.js CVE-2026-27496

Q: What is the CVSS score of CVE-2026-27496?

CVE-2026-27496 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15938 HIGH

Use of Uninitialized Resource (CWE-908)

2026-03-25 https://github.com/n8n-io/n8n

GHSA-xvh5-5qg4-x9qp

Node.js Information Disclosure

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 17:01 euvd

EUVD-2026-15938

Analysis Generated

Mar 25, 2026 - 17:01 vuln.today

CVE Published

Mar 25, 2026 - 17:00 nvd

HIGH 7.1

DescriptionGitHub Advisory

Impact

An authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process - including data from prior requests, tasks, secrets, or tokens - resulting in information disclosure of sensitive in-process data.

Task Runners must be enabled using N8N_RUNNERS_ENABLED=true.
In external runner mode, the impact is limited to data within the external runner process.

Patches

The issue has been fixed in n8n versions >= 1.123.22, >= 2.10.1 , and >= 2.9.3. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Use external runner mode (N8N_RUNNERS_MODE=external) to isolate the runner process.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

An information disclosure vulnerability exists in n8n workflow automation software when Task Runners are enabled, allowing authenticated users with workflow creation or modification permissions to allocate uninitialized memory buffers through the JavaScript Task Runner. These buffers may contain residual data from the same Node.js process including secrets, tokens, and data from prior requests, leading to sensitive information exposure. This vulnerability requires CVE-2026-27496 has a CVSS 4.0 score of 7.1 with high confidentiality impact and affects npm package installations of n8n.

Technical ContextAI

This vulnerability affects the n8n workflow automation platform (pkg:npm/n8n) and stems from CWE-908 (Use of Uninitialized Resource). The issue occurs within the JavaScript Task Runner feature when N8N_RUNNERS_ENABLED is set to true. The Node.js runtime allocates memory buffers without proper initialization, leaving residual data from the heap memory of the same process. In Node.js applications handling multiple requests and storing sensitive data in memory (authentication tokens, secrets, user data), uninitialized buffers can leak this information across security boundaries. The vulnerability is scoped to authenticated users with specific workflow permissions, and the attack surface can be reduced by operating the runner in external mode (N8N_RUNNERS_MODE=external), which isolates the runner process from the main n8n process, thereby limiting the scope of potentially leaked data.

RemediationAI

Upgrade n8n to version 1.123.22 or later for the 1.x series, version 2.9.3 or later for the 2.9.x series, or version 2.10.1 or later for the 2.10.x series as documented in the vendor security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp. If immediate patching is not feasible, implement temporary mitigations by restricting workflow creation and editing permissions to only fully trusted users and deploying Task Runners in external mode using the N8N_RUNNERS_MODE=external configuration to isolate the runner process from the main application. Additional guidance on securing n8n deployments and blocking specific nodes is available at https://docs.n8n.io/hosting/securing/blocking-nodes. Note that these workarounds provide partial risk reduction and should only be considered short-term measures until patching can be completed.