n8n - ✅(Solved) Fix Security: n8n 2.15.0 ships axios 1.13.5 vulnerable to SSRF (CVE-2025-62718) [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
n8n-io/n8n#28283Fetched 2026-04-11 06:31:02
View on GitHub
Comments
1
Participants
2
Timeline
7
Reactions
0
Author
Timeline (top)
labeled ×3subscribed ×2commented ×1mentioned ×1

n8n 2.15.0 bundles [email protected], which is affected by CVE-2025-62718 (GHSA-3p68-rc4w-qgx5, severity: Critical).

This is a Server-Side Request Forgery (SSRF) vulnerability caused by improper hostname normalization when evaluating the NO_PROXY environment variable. An attacker can craft requests that bypass NO_PROXY rules, potentially accessing internal network resources (e.g., cloud metadata endpoints).

Root Cause

This is a Server-Side Request Forgery (SSRF) vulnerability caused by improper hostname normalization when evaluating the NO_PROXY environment variable. An attacker can craft requests that bypass NO_PROXY rules, potentially accessing internal network resources (e.g., cloud metadata endpoints).

Fix Action

Fix

Upgrade axios to 1.15.0 or later, which addresses this vulnerability.

PR fix notes

PR #10625: Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.…

Description (problem / solution / changelog)

Fix DEP0169 warning in Node.js 18+ by prioritizing fetch adapter

This pull request fixes the DEP0169 warning caused by follow-redirects using the legacy url.format() API internally when building redirect URLs. Axios uses follow-redirects via the HTTP adapter, which triggers this warning in Node.js 18+.

Solution:

In Node.js 18+ (where platform.isNode is true and global.fetch exists), the adapter priority is updated to ['xhr', 'fetch', 'http']. This ensures the native fetch adapter is used instead of the HTTP adapter. Since fetch does not rely on follow-redirects, the warning is eliminated. On older Node.js versions (<18) or in browsers, the original adapter order is preserved, so functionality remains unchanged and backward compatibility is maintained.

<!-- This is an auto-generated description by cubic. -->

Summary by cubic

Fixes #10610 by replacing deprecated url.parse with URL/URLSearchParams in examples, sandbox, and tests. Removes Node v22 deprecation warnings and includes a tiny cleanup in lib/adapters/http.js (no behavior change).

Description

  • Replaced url.parse with URL/URLSearchParams in examples/abort-controller/server.js, sandbox/server.js, and tests.
  • Added 400 handling for invalid URLs in examples/abort-controller/server.js.
  • Minor cleanup in lib/adapters/http.js (formatting only).
  • Reasoning: Use WHATWG URL API and silence Node v22 deprecation warnings.

Docs

  • No API changes. Update any docs/snippets that use url.parse to URL/URLSearchParams.

Testing

  • Updated tests/unit/adapters/http.test.js to use URL; behavior unchanged.
  • No new tests needed. Run CI on Node v22 to confirm no deprecation warnings.

<sup>Written for commit 6da3bf494298f096e132fd87cb762740727273e4. Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

Changed files

  • examples/abort-controller/server.js (modified, +9/-4)
  • lib/adapters/http.js (modified, +0/-1)
  • sandbox/server.js (modified, +2/-3)
  • tests/unit/adapters/http.test.js (modified, +2/-3)
RAW_BUFFERClick to expand / collapse

Summary

n8n 2.15.0 bundles [email protected], which is affected by CVE-2025-62718 (GHSA-3p68-rc4w-qgx5, severity: Critical).

This is a Server-Side Request Forgery (SSRF) vulnerability caused by improper hostname normalization when evaluating the NO_PROXY environment variable. An attacker can craft requests that bypass NO_PROXY rules, potentially accessing internal network resources (e.g., cloud metadata endpoints).

Affected locations

The following paths in n8nio/n8n:2.15.0 contain [email protected]:

The task runner image n8nio/runners:2.15.0 is also affected:

  • /opt/runners/task-runner-javascript/node_modules/.pnpm/[email protected]/node_modules/axios/

Fix

Upgrade axios to 1.15.0 or later, which addresses this vulnerability.

References

extent analysis

TL;DR

Upgrade axios to version 1.15.0 or later to address the critical Server-Side Request Forgery (SSRF) vulnerability.

Guidance

  • Verify the version of axios currently in use by checking the package.json file or the .pnpm/axios directory.
  • Upgrade axios to 1.15.0 or later by running a command like pnpm install [email protected] or by updating the package.json file and running pnpm install.
  • Check the task runner image n8nio/runners:2.15.0 for the vulnerable axios version and consider rebuilding the image with the updated axios version.
  • Review the references provided for more information on the vulnerability and the fix.

Example

No code snippet is necessary for this fix, as it involves updating a package version.

Notes

This fix assumes that the axios package is being used in a JavaScript project managed by pnpm. If a different package manager is being used, the upgrade command may vary.

Recommendation

Apply the workaround by upgrading axios to 1.15.0 or later, as this directly addresses the critical SSRF vulnerability and is a straightforward fix.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING