CVE-2025-61917 - CVE House

Back to Database

Status published High CVE-2025-61917

n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner

7.7 CVSS

Vulnerability Description

n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the same Node.js process (for example, data from prior requests, tasks, secrets, or tokens), resulting in potential information disclosure. This issue has been patched in version 1.114.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61917

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from n8n-io

View All →

n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching

Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

n8n Vulnerable to Remote Code Execution via Expression Injection

n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

Affected Vendor

n8n-io

View all reports →

Affected Software

n8n

Vulnerable Versions:

>= 1.65.0, < 1.114.3

Timeline

Official Publish: February 4th, 2026

Last Modified: February 5th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-668 CWE-200

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1078 Valid Accounts

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel