CVE-2025-61917

Katalog CVE

CVSS 7.7 · High EPSS 0,40%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada n8n. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the same Node.js process (for example, data from prior requests, tasks, secrets, or tokens), resulting in potential information disclosure. This issue has been patched in version 1.114.3.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-49mx-fj45-q3p6 mitigasi · advisory vendor
• https://github.com/n8n-io/n8n/commit/2c4c2953199733c791f739a40879ae31ca129aba patch