Saltar al contenido
QuenchWorks

n8n

Imagen · Workflow · standard · v2.40.7

F 41firmada con cosignSPDX SBOMprocedencia SLSAamd64 · arm64Reconstruida 2026-10-22

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Digest actual (desplegado por el chart)

sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb

Las firmas, el SBOM y la procedencia se adjuntan a este digest. Fíjate a él para descargas reproducibles y a prueba de manipulaciones.

Imagen
ghcr.io/quenchworks/images/n8n:2.40.7
Firmada
cosign sin llave
SBOM
SPDX, en el digest
Procedencia
compilación SLSA
Arquitecturas
amd64, arm64
Se ejecuta como
nonroot (uid 1001)
Sistema de archivos raíz
solo lectura
Tamaño de la imagen
399.8 MB

Versiones publicadas

1 etiqueta

Cada etiqueta es un índice multiarquitectura (amd64 + arm64) fijado por digest. Etiquetada por versión, nunca :latest.

VersiónTamañoPublicadaDigest
2.40.7última399.8 MB2026-10-22sha256:c095cfd91d5b…

Informe de seguridad (Trivy)

F· 0/10036 fixable · rebuild clears them

Detalle de vulnerabilidades

n8n 2.40.7 · 36 CVE
CVEGravedadPaqueteInstaladaCorregida enTítulo
CVE-2026-115905CRITICALzip8.2.09.0.5zip is a zip library for Rust that supports reading and writing simple ...
CVE-2026-109383HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109383HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109461HIGH@azure/msal-node5.1.57.1.0MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109461HIGH@azure/msal-node6.0.17.1.0MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109829HIGHundici7.29.17.30.1, 8.12.2undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching
CVE-2026-109869HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-109869HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-111181HIGHbody-parser2.3.02.4.0, 1.20.9body-parser: body-parser: Denial of Service via unhandled decompression stream error
CVE-2026-113872HIGHmulter2.4.02.5.0multer: multer: Denial of Service via aborted request during asynchronous file filtering
CVE-2026-114141HIGHtoml4.2.05.0.1toml: toml: Denial of Service via crafted array-of-tables headers
CVE-2026-114142HIGHtoml4.2.05.0.1toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114143HIGHtoml4.2.05.0.1toml: toml-node: Denial of Service via long dotted keys in TOML input
CVE-2026-114144HIGHtoml4.2.05.0.1toml: toml-node: Denial of Service via unbounded integer parsing
CVE-2026-87018HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
CVE-2026-87018HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
GHSA-f897-62hf-6gxqHIGH@modelcontextprotocol/node2.0.02.1.0MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
CVE-2026-109841MEDIUMundici7.29.17.30.1, 8.12.2undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
CVE-2026-109924MEDIUMundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109924MEDIUMundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109932MEDIUMundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-109932MEDIUMundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-110816MEDIUMqs6.16.06.16.1qs: qs: Denial of Service via unhandled exception during array serialization
CVE-2026-114129MEDIUMstream-json3.6.03.7.0stream-json: stream-json: Denial of Service via deeply nested JSON documents
CVE-2026-118663MEDIUM@hono/node-server2.0.102.1.3@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
CVE-2026-87029MEDIUMundici7.29.17.30.1, 8.12.2undici: undici: Denial of Service via unhandled exception in decompress interceptor
GHSA-4ffr-jq9g-5ffxMEDIUMnodemailer10.0.1010.0.13Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-85x2-q946-cp5hMEDIUMnodemailer10.0.1010.1.4Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-8c8m-p3m8-cjg8MEDIUMnodemailer10.0.1010.1.4Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-g73g-hqqh-jr95MEDIUMnodemailer10.0.1010.0.13Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-m943-m63m-w62wMEDIUMnodemailer10.0.1010.1.4Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
CVE-2024-1899MEDIUMshowdown2.1.0— sin correcciónShowdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2025-57665MEDIUMelement-plus2.4.3— sin correcciónElement Plus Link component (el-link) implements insufficient input validation for the href attribute
CVE-2026-59710MEDIUMshowdown2.1.0— sin correcciónshowdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711MEDIUMshowdown2.1.0— sin correcciónshowdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-93753LOWdeepmerge4.3.1— sin correccióndeepmerge: deepmerge: Prototype Poisoning via mergeObject function
1
Crítica
19
Alta
20
Media
1
Baja
0
Desconocida
fixable per nightly scan · peak 4164 of 115 days with any · 2026-06-29 to 2026-10-22

Descarga la imagen

Ejecútala directamente con Docker, Podman o cualquier carga de trabajo de Kubernetes. Sin root, sistema de archivos raíz de solo lectura, compilada para amd64 y arm64.

Descargar (etiqueta)

docker pull ghcr.io/quenchworks/images/n8n:2.40.7

Fijada por digest (recomendado)

docker pull ghcr.io/quenchworks/images/n8n@sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb

Etiquetas

2.40.72.40.7-amd642.40.7-arm64

Las imágenes se etiquetan por versión de la app (nunca :latest): un índice multiarquitectura más etiquetas por arquitectura.

Versión de la app
2.40.7
Arquitecturas
amd64, arm64
Se ejecuta como
nonroot (uid 1001)
Sistema de archivos raíz
solo lectura
Licencia
LicenseRef-n8n-Sustainable-Use-License-1.0

Verifica la cadena de suministro

Esta imagen está firmada con cosign y lleva un SBOM SPDX y una atestación de procedencia de compilación SLSA en el mismo digest. Comprueba las tres tú mismo:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Consulta la guía de SBOM y procedencia para leer el SBOM y usar estas comprobaciones en CI.

Transparencia

Cada imagen lleva su SBOM y su procedencia como atestaciones en el mismo digest, verificables públicamente con los comandos anteriores (comprueban el paquete y el registro de transparencia de Sigstore, Rekor).

Ver el chart de HelmVer el paquete

Proyecto original: https://n8n.io