n8n

Image · Workflow · standard · v2.40.7

F 41cosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-22

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Current digest (deployed by the chart)

sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb

Signatures, the SBOM, and provenance all attach to this digest. Pin to it for reproducible, tamper-evident pulls.

Image

ghcr.io/quenchworks/images/n8n:2.40.7

Signed

cosign keyless

SBOM

SPDX, on digest

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

399.8 MB

Published versions

1 tag

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Version	Size	Published	Digest
2.40.7latest	399.8 MB	2026-10-22	sha256:c095cfd91d5b…

Security report (Trivy)

F· 0/10036 fixable · rebuild clears them

Vulnerability detail

n8n 2.40.7 · 36 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-115905	CRITICAL	zip	8.2.0	9.0.5	zip is a zip library for Rust that supports reading and writing simple ...
CVE-2026-109383	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109383	HIGH	undici	7.29.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109461	HIGH	@azure/msal-node	5.1.5	7.1.0	MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109461	HIGH	@azure/msal-node	6.0.1	7.1.0	MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109829	HIGH	undici	7.29.1	7.30.1, 8.12.2	undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching
CVE-2026-109869	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-109869	HIGH	undici	7.29.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-111181	HIGH	body-parser	2.3.0	2.4.0, 1.20.9	body-parser: body-parser: Denial of Service via unhandled decompression stream error
CVE-2026-113872	HIGH	multer	2.4.0	2.5.0	multer: multer: Denial of Service via aborted request during asynchronous file filtering
CVE-2026-114141	HIGH	toml	4.2.0	5.0.1	toml: toml: Denial of Service via crafted array-of-tables headers
CVE-2026-114142	HIGH	toml	4.2.0	5.0.1	toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114143	HIGH	toml	4.2.0	5.0.1	toml: toml-node: Denial of Service via long dotted keys in TOML input
CVE-2026-114144	HIGH	toml	4.2.0	5.0.1	toml: toml-node: Denial of Service via unbounded integer parsing
CVE-2026-87018	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
CVE-2026-87018	HIGH	undici	7.29.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
GHSA-f897-62hf-6gxq	HIGH	@modelcontextprotocol/node	2.0.0	2.1.0	MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
CVE-2026-109841	MEDIUM	undici	7.29.1	7.30.1, 8.12.2	undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
CVE-2026-109924	MEDIUM	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109924	MEDIUM	undici	7.29.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109932	MEDIUM	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-109932	MEDIUM	undici	7.29.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-110816	MEDIUM	qs	6.16.0	6.16.1	qs: qs: Denial of Service via unhandled exception during array serialization
CVE-2026-114129	MEDIUM	stream-json	3.6.0	3.7.0	stream-json: stream-json: Denial of Service via deeply nested JSON documents
CVE-2026-118663	MEDIUM	@hono/node-server	2.0.10	2.1.3	@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
CVE-2026-87029	MEDIUM	undici	7.29.1	7.30.1, 8.12.2	undici: undici: Denial of Service via unhandled exception in decompress interceptor
GHSA-4ffr-jq9g-5ffx	MEDIUM	nodemailer	10.0.10	10.0.13	Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-85x2-q946-cp5h	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-8c8m-p3m8-cjg8	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-g73g-hqqh-jr95	MEDIUM	nodemailer	10.0.10	10.0.13	Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-m943-m63m-w62w	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
CVE-2024-1899	MEDIUM	showdown	2.1.0	— not fixable	Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2025-57665	MEDIUM	element-plus	2.4.3	— not fixable	Element Plus Link component (el-link) implements insufficient input validation for the href attribute
CVE-2026-59710	MEDIUM	showdown	2.1.0	— not fixable	showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711	MEDIUM	showdown	2.1.0	— not fixable	showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-93753	LOW	deepmerge	4.3.1	— not fixable	deepmerge: deepmerge: Prototype Poisoning via mergeObject function

Critical

High

Medium

Low

Unknown

fixable per nightly scan · peak 4164 of 115 days with any · 2026-06-29 to 2026-10-22

Pull the image

Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.

Pull (tag)

docker pull ghcr.io/quenchworks/images/n8n:2.40.7

Pinned by digest (recommended)

docker pull ghcr.io/quenchworks/images/n8n@sha256:c095cfd91d5b23674026513f780215c527ffe301142596c0cb199cb36fa3e0cb

Tags

2.40.72.40.7-amd642.40.7-arm64

Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.

App version: 2.40.7
Architectures: amd64, arm64
Runs as: nonroot (uid 1001)
Root filesystem: read-only
License: LicenseRef-n8n-Sustainable-Use-License-1.0

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Transparency

Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).

View the Helm chart View package

Upstream project: https://n8n.io