Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD5.3 Medium

CVE-2026-85172

n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 2.34.0 to < 2.34.1affected
  • 2.34.1unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 0 to < 2.33.4affected
  • 2.33.4unaffected
pkg:npm/n8n

References