n8n - ✅(Solved) Fix n8nio/n8n:2.17.7 ships vulnerable OpenSSL 3.5.5-r0 (CVE-2026-31789) and protobufjs 7.4.0 / 7.5.4 (CVE-2026-41242) [1 pull requests, 1 comments, 2 participants]

noahxp · 2026-04-24T12:46:04Z

[n8n] The official n8nio/n8n:2.17.7 image currently fails trivy image --severity CRITICAL with the following findings, straight from the upstream image no down… The official `n8nio/n8n:2.17.7` image currently fails `trivy image --severity CRITICAL` with the following findings, straight from the upstream image (no downstream layers involved): | Target | Package | CVE | Severity | Installed | Fixed | |----------------------------------|--------------|------------------|----------|-------------------|---------------| | `n8nio/n8n:2.17.7` (alpine 3.22) | `libcrypto3` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | `n8nio/n8n:2.17.7` (alpine 3.22) | `libssl3` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | `n8nio/n8n:2.17.7` (alpine 3.22) | `openssl` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | Node.js | `protobufjs` | CVE-2026-41242 | CRITICAL | `7.4.0` | `7.5.5`, `8.0.1` | | Node.js | `protobufjs` | CVE-2026-41242 | CRITICAL | `7.5.4` | `7.5.5`, `8.0.1` | This blocks users whose CI enforces `trivy image --severity CRITICAL --exit-code 1` on images derived from `n8nio/n8n: `. # PR #29097: fix(core): Pin Alpine version in Docker builder stages for reproducible builds - Repository: n8n-io/n8n - Author: shortstacked - State: closed | merged: True - Link: https://github.com/n8n-io/n8n/pull/29097 ## Description (problem / solution / changelog) ## Summary Pin all Docker builder stages from the floating `node:${NODE_VERSION}-alpine` tag to `node:${NODE_VERSION}-alpine3.22`, matching the already-pinned base image (`n8n-base/Dockerfile`). The floating `-alpine` tag rolled forward to Alpine 3.23, which ships gcc 15.2 — this segfaults when compiling `isolated-vm@6.0.2` during `npm rebuild`, breaking Docker image builds. **Changes:** - `docker/images/n8n/Dockerfile` — builder stage pinned to `alpine3.22` - `docker/images/runners/Dockerfile` — JS runner builder and node-alpine stages pinned to `alpine3.22` This also enables a clean rebuild that picks up fixes for CVE-2026-31789 (OpenSSL) and CVE-2026-41242 (protobufjs) from #29093. ## Related Linear tickets, Github issues, and Community forum posts Fixes https://github.com/n8n-io/n8n/issues/28917 Related https://github.com/n8n-io/n8n/issues/29093 ## Review / Merge checklist - [x] I have seen this code, I have run this code, and I take responsibility for this code. - [x] PR title and summary are descriptive. ([conventions](../blob/master/.github/pull_request_title_conventions.md)) - [ ] [Docs updated](https://github.com/n8n-io/n8n-docs) or follow-up ticket created. - [ ] Tests included. - [ ] PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if the PR is an urgent fix that needs to be backported) ## Changed files - `docker/images/n8n/Dockerfile` (modified, +1/-1) - `docker/images/runners/Dockerfile` (modified, +2/-2) ## Fix / Workaround Because the base is a Docker Hardened Image, `apk` is unavailable inside the running image, so downstream consumers cannot patch OpenSSL themselves without copying `libssl.so.3` / `libcrypto.so.3` from a stock `alpine:3.22` stage — an approach we'd rather avoid on a security-hardened base. ## Summary The official `n8nio/n8n:2.17.7` image currently fails `trivy image --severity CRITICAL` with the following findings, straight from the upstream image (no downstream layers involved): | Target | Package | CVE | Severity | Installed | Fixed | |----------------------------------|--------------|------------------|----------|-------------------|---------------| | `n8nio/n8n:2.17.7` (alpine 3.22) | `libcrypto3` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | `n8nio/n8n:2.17.7` (alpine 3.22) | `libssl3` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | `n8nio/n8n:2.17.7` (alpine 3.22) | `openssl` | CVE-2026-31789 | CRITICAL | `3.5.5-r0` | `3.5.6-r0` | | Node.js | `protobufjs` | CVE-2026-41242 | CRITICAL | `7.4.0` | `7.5.5`, `8.0.1` | | Node.js | `protobufjs` | CVE-2026-41242 | CRITICAL | `7.5.4` | `7.5.5`, `8.0.1` | This blocks users whose CI enforces `trivy image --severity CRITICAL --exit-code 1` on images derived from `n8nio/n8n: `. ## Reproduction ```bash docker pull n8nio/n8n:2.17.7 trivy image --severity CRITICAL n8nio/n8n:2.17.7 ``` OS detection from inside the image: ``` NAME="Docker Hardened Images (Alpine)" ID=alpine VERSION_ID=3.22 PRETTY_NAME="Docker Hardened Images/Alpine Linux v3.22" ``` Because the base is a Docker Hardened Image, `apk` is unavailable inside the running image, so downstream consumers cannot patch OpenSSL themselves without copying `libssl.so.3` / `libcrypto.so.3` from a stock `alpine:3.22` stage — an approach we'd rather avoid on a security-hardened base. For `protobufjs`, two versions (`7.4.0` and `7.5.4`) remain in `/usr/local/lib/node_modules/n8n/node_modules/.pnpm/` despite `7.5.5` being available since November 2025. ## Scope - Affected: `n8nio/n8n:2.17.7` (confirmed). Likely also earlier 2.17.x tags and recent 1.123.x tags sharin

n8n2026-04-24 12:46:04

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

n8n-io/n8n#29093•Fetched 2026-04-25 06:21:48

View on GitHub

Comments

Participants

Timeline

Reactions

Author

noahxp

Participants

n8n-assistant[bot]

noahxp

Timeline (top)

commented ×1cross-referenced ×1labeled ×1mentioned ×1

The official n8nio/n8n:2.17.7 image currently fails trivy image --severity CRITICAL with the following findings, straight from the upstream image (no downstream layers involved):

Target	Package	CVE	Severity	Installed	Fixed
`n8nio/n8n:2.17.7` (alpine 3.22)	`libcrypto3`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
`n8nio/n8n:2.17.7` (alpine 3.22)	`libssl3`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
`n8nio/n8n:2.17.7` (alpine 3.22)	`openssl`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
Node.js	`protobufjs`	CVE-2026-41242	CRITICAL	`7.4.0`	`7.5.5`, `8.0.1`
Node.js	`protobufjs`	CVE-2026-41242	CRITICAL	`7.5.4`	`7.5.5`, `8.0.1`

This blocks users whose CI enforces trivy image --severity CRITICAL --exit-code 1 on images derived from n8nio/n8n:<tag>.

Root Cause

Because the base is a Docker Hardened Image, apk is unavailable inside the running image, so downstream consumers cannot patch OpenSSL themselves without copying libssl.so.3 / libcrypto.so.3 from a stock alpine:3.22 stage — an approach we'd rather avoid on a security-hardened base.

Fix Action

Fix / Workaround

PR fix notes

PR #29097: fix(core): Pin Alpine version in Docker builder stages for reproducible builds

Repository: n8n-io/n8n
Author: shortstacked
State: closed | merged: True
Link: https://github.com/n8n-io/n8n/pull/29097

Description (problem / solution / changelog)

Summary

Pin all Docker builder stages from the floating node:${NODE_VERSION}-alpine tag to node:${NODE_VERSION}-alpine3.22, matching the already-pinned base image (n8n-base/Dockerfile).

The floating -alpine tag rolled forward to Alpine 3.23, which ships gcc 15.2 — this segfaults when compiling [email protected] during npm rebuild, breaking Docker image builds.

Changes:

docker/images/n8n/Dockerfile — builder stage pinned to alpine3.22
docker/images/runners/Dockerfile — JS runner builder and node-alpine stages pinned to alpine3.22

This also enables a clean rebuild that picks up fixes for CVE-2026-31789 (OpenSSL) and CVE-2026-41242 (protobufjs) from #29093.

Related Linear tickets, Github issues, and Community forum posts

Fixes https://github.com/n8n-io/n8n/issues/28917 Related https://github.com/n8n-io/n8n/issues/29093

Review / Merge checklist

I have seen this code, I have run this code, and I take responsibility for this code.
PR title and summary are descriptive. (conventions)
Docs updated or follow-up ticket created.
Tests included.
PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

Changed files

docker/images/n8n/Dockerfile (modified, +1/-1)
docker/images/runners/Dockerfile (modified, +2/-2)

Code Example

docker pull n8nio/n8n:2.17.7
trivy image --severity CRITICAL n8nio/n8n:2.17.7

---

NAME="Docker Hardened Images (Alpine)"
ID=alpine
VERSION_ID=3.22
PRETTY_NAME="Docker Hardened Images/Alpine Linux v3.22"

RAW_BUFFERClick to expand / collapse

Summary

The official n8nio/n8n:2.17.7 image currently fails trivy image --severity CRITICAL with the following findings, straight from the upstream image (no downstream layers involved):

Target	Package	CVE	Severity	Installed	Fixed
`n8nio/n8n:2.17.7` (alpine 3.22)	`libcrypto3`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
`n8nio/n8n:2.17.7` (alpine 3.22)	`libssl3`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
`n8nio/n8n:2.17.7` (alpine 3.22)	`openssl`	CVE-2026-31789	CRITICAL	`3.5.5-r0`	`3.5.6-r0`
Node.js	`protobufjs`	CVE-2026-41242	CRITICAL	`7.4.0`	`7.5.5`, `8.0.1`
Node.js	`protobufjs`	CVE-2026-41242	CRITICAL	`7.5.4`	`7.5.5`, `8.0.1`

This blocks users whose CI enforces trivy image --severity CRITICAL --exit-code 1 on images derived from n8nio/n8n:<tag>.

Reproduction

docker pull n8nio/n8n:2.17.7
trivy image --severity CRITICAL n8nio/n8n:2.17.7

OS detection from inside the image:

NAME="Docker Hardened Images (Alpine)"
ID=alpine
VERSION_ID=3.22
PRETTY_NAME="Docker Hardened Images/Alpine Linux v3.22"

For protobufjs, two versions (7.4.0 and 7.5.4) remain in /usr/local/lib/node_modules/n8n/node_modules/.pnpm/ despite 7.5.5 being available since November 2025.

Scope

Affected: n8nio/n8n:2.17.7 (confirmed). Likely also earlier 2.17.x tags and recent 1.123.x tags sharing the same base / pnpm lockfile.
Not affected: n8nio/runners:2.17.7 — Trivy reports 0 CRITICAL.

Ask

OpenSSL: Rebuild and re-publish n8nio/n8n:2.17.7 (and other affected stable tags) once openssl 3.5.6-r0 lands in the Docker Hardened Images / Alpine 3.22 channel. Please confirm whether the image build pipeline auto-rebuilds on DHI updates, or whether a base image pin needs to be bumped manually.
protobufjs: Bump transitive dependencies so [email protected] (or 8.x) is the only resolved version in the published image.
Tracking: Consider publicly tracking container-level CVEs like this, so downstream consumers with CI gating have remediation ETA visibility.

References

CVE-2026-31789 — OpenSSL heap buffer overflow on 32-bit systems from large X.509 certificates (fixed in 3.5.6).
CVE-2026-41242 — protobufjs (fixed in 7.5.5 / 8.0.1).
Related ecosystem tracking issues for CVE-2026-31789:
- nodejs/nodejs-dependency-vuln-assessments#291, #297
- microsoft/azurelinux#16783
- gardenlinux/gardenlinux#4615

Happy to validate a fix once rebuilt images are pushed.

extent analysis

TL;DR

The most likely fix involves rebuilding and re-publishing the n8nio/n8n:2.17.7 image with updated openssl and protobufjs versions to address critical CVEs.

Guidance

Rebuild the n8nio/n8n:2.17.7 image with openssl 3.5.6-r0 once it becomes available in the Docker Hardened Images / Alpine 3.22 channel.
Bump transitive dependencies to ensure [email protected] (or 8.x) is the only resolved version in the published image.
Consider publicly tracking container-level CVEs to provide remediation ETA visibility for downstream consumers.
Validate the fix by re-running trivy image --severity CRITICAL on the rebuilt image.

Example

No code snippet is provided as the issue is related to image rebuilding and dependency updates.

Notes

The fix relies on the availability of openssl 3.5.6-r0 in the Docker Hardened Images / Alpine 3.22 channel. Additionally, the image build pipeline's behavior regarding auto-rebuilds on DHI updates needs to be confirmed.

Recommendation

Apply a workaround by rebuilding and re-publishing the affected images with updated dependencies, as the root cause is related to specific version vulnerabilities.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#prompt formatting #chain error #conversation history #tool integration #LLM response

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

n8n - ✅(Solved) Fix n8nio/n8n:2.17.7 ships vulnerable OpenSSL 3.5.5-r0 (CVE-2026-31789) and protobufjs 7.4.0 / 7.5.4 (CVE-2026-41242) [1 pull requests, 1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fix / Workaround

PR fix notes

PR #29097: fix(core): Pin Alpine version in Docker builder stages for reproducible builds

Description (problem / solution / changelog)

Summary

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

Changed files

Code Example

Summary

Reproduction

Scope

Ask

References

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

TRENDING

n8n - ✅(Solved) Fix n8nio/n8n:2.17.7 ships vulnerable OpenSSL 3.5.5-r0 (CVE-2026-31789) and protobufjs 7.4.0 / 7.5.4 (CVE-2026-41242) [1 pull requests, 1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fix / Workaround

PR fix notes

PR #29097: fix(core): Pin Alpine version in Docker builder stages for reproducible builds

Description (problem / solution / changelog)

Summary

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

Changed files

Code Example

Summary

Reproduction

Scope

Ask

References

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

RELATED_DISCOVERY

TRENDING