Security advisories

medium2026-07-22

CVE-2026-65593-n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

n8n-io/n8n · GHSA-9w78-79q7-r4fp

high2026-07-22

CVE-2026-65595-n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

n8n-io/n8n · GHSA-777w-rpr6-c52h

high2026-07-22

CVE-2026-59208-n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

n8n-io/n8n · GHSA-mq3m-f8x3-579w

high2026-07-22

CVE-2026-59207-n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n-io/n8n · GHSA-h44j-f5r5-ph73

high2026-07-22

CVE-2026-59206-n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n-io/n8n · GHSA-75qm-gp28-rcq9

high2026-07-22

CVE-2026-59209-n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

n8n-io/n8n · GHSA-q3j5-8vrg-4p9q

medium2026-07-22

CVE-2026-59921-Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

netty/netty · GHSA-gcjf-9mgh-3p7g

medium2026-07-22

CVE-2026-59920-Netty: STOMP CONNECT Frame Header Injection in Netty

netty/netty · GHSA-3g8r-4pfx-jmfh

medium2026-07-22

CVE-2026-59919-Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

netty/netty · GHSA-wh89-7897-x99h

high2026-07-22

CVE-2026-59901-Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

netty/netty · GHSA-558v-64gr-wgg4

medium2026-07-22

CVE-2026-59900-Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

netty/netty · GHSA-c69g-56f8-xwqj

medium2026-07-22

CVE-2026-59899-Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

netty/netty · GHSA-q4f6-jm68-57ww

medium2026-07-22

CVE-2026-59898-Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

netty/netty · GHSA-4mp9-239f-g9hg

high2026-07-22

CVE-2026-56822-Netty: TOCTOU in OcspServerCertificateValidator

netty/netty · GHSA-wc96-39fc-566f

high2026-07-22

CVE-2026-56821-Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

netty/netty · GHSA-g7hg-vrcf-mvmr

high2026-07-22

CVE-2026-56820-Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

netty/netty · GHSA-272m-gcwp-mpwg

high2026-07-22

CVE-2026-56817-Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

netty/netty · GHSA-4qhr-g3c6-fcfx

high2026-07-22

CVE-2026-56816-Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

netty/netty · GHSA-hpcc-26xq-25fv

medium2026-07-22

CVE-2026-56746-Netty: Security Control Bypass via CORS Short-Circuit Failure

netty/netty · GHSA-6cqp-g7gg-8hr5

high2026-07-22

CVE-2026-56745-Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

netty/netty · GHSA-jppx-w49h-x2qq