High · published February 4, 2026
⚡ A crafty oversight in n8n’s task runner could let sneaky attackers peek into uninitialized memory! 🚨 Think of it like a restaurant where the chef doesn’t clean the kitchen thoroughly before the next cook arrives; leftover ingredients might end up in the new dish! Similarly, uninitialized buffers in n8n can leak sensitive data like secrets and tokens from previous tasks. An attacker could exploit this vulnerability to access sensitive information that should remain hidden, potentially revealing secrets, tokens, or even personal data from prior requests. The consequences could be absolutely devastating for users relying on n8n to keep their workflows private and secure.
Think of it like a restaurant where the chef doesn’t clean the kitchen thoroughly before the next cook arrives; leftover ingredients might end up in the new dish! Similarly, uninitialized buffers in n8n can leak sensitive data like secrets and tokens from previous tasks. The vulnerability arises from the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in n8n versions 1.65.0 to before 1.114.3, allowing untrusted code to allocate memory that may still hold residual data from earlier operations in the Node.js process.
An attacker could exploit this vulnerability to access sensitive information that should remain hidden, potentially revealing secrets, tokens, or even personal data from prior requests. The consequences could be absolutely devastating for users relying on n8n to keep their workflows private and secure. Upgrade n8n to version 1.114.3 or later immediately to patch this vulnerability. Review your workflows for any potential exposure of sensitive data and ensure that proper memory handling practices are in place. You’ve got this! With a quick update, you’ll fortify your n8n instance against this sneaky oversight and keep your automation secure! 🛡️