High, CVSS 7.1
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72771 · GHSA-64xh-79j6-r5v8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–75 of 86 matching · newest first
- High, CVSS 8.9
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
npm n8n · Upgrade to 2.32.1 or 2.31.5 by release line · >= 2.32.0, < 2.32.1; < 2.31.5 · CVE-2026-72772 · GHSA-8342-988q-86cr · amended
- High, CVSS 7.7
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65016 · GHSA-35q8-9mj6-wjmf · amended
- High, CVSS 8.9
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65591 · GHSA-pm35-fqvh-cq5g · amended
- Medium, CVSS 6.3
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65593 · GHSA-9w78-79q7-r4fp · amended
- High, CVSS 8.9
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65595 · GHSA-777w-rpr6-c52h · amended
- High, CVSS 7.6
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
npm n8n · Upgrade to 2.28.1 or 2.27.4 by release line · >= 2.28.0, < 2.28.1; < 2.27.4 · CVE-2026-59208 · GHSA-mq3m-f8x3-579w · amended
- High, CVSS 7.1
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
npm n8n · Upgrade to 2.28.1 or 2.27.4 by release line · >= 2.28.0, < 2.28.1; < 2.27.4 · CVE-2026-59207 · GHSA-h44j-f5r5-ph73 · amended
- High, CVSS 7.1
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59206 · GHSA-75qm-gp28-rcq9 · amended
- High, CVSS 7.1
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
npm n8n · Upgrade to 2.28.1, 2.27.4 or 1.123.61 by release line · < 1.123.61; >= 2.28.0, < 2.28.1; >= 2.0.0-rc.0, < 2.27.4 · CVE-2026-59209 · GHSA-q3j5-8vrg-4p9q · amended
- Medium, CVSS 5.7
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59921 · GHSA-gcjf-9mgh-3p7g
- Medium, CVSS 6.5
Netty: STOMP CONNECT Frame Header Injection in Netty
Maven io.netty:netty-codec-stomp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59920 · GHSA-3g8r-4pfx-jmfh
- Medium, CVSS 5.5
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Maven io.netty:netty-codec-haproxy · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-59919 · GHSA-wh89-7897-x99h
- High, CVSS 8.7
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Maven io.netty:netty-codec-compression · Upgrade to 4.2.16.Final or later · >= 4.2.0.Final, < 4.2.16.Final · +1 more package · CVE-2026-59901 · GHSA-558v-64gr-wgg4
- Medium, CVSS 6.9
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Maven io.netty:netty-codec-http2 · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59900 · GHSA-c69g-56f8-xwqj
- Medium, CVSS 6.9
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59899 · GHSA-q4f6-jm68-57ww
- Medium, CVSS 6.3
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; < 4.1.136.Final · CVE-2026-59898 · GHSA-4mp9-239f-g9hg
- High, CVSS 7.4
Netty: TOCTOU in OcspServerCertificateValidator
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56822 · GHSA-wc96-39fc-566f
- High, CVSS 7.4
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56821 · GHSA-g7hg-vrcf-mvmr
- High, CVSS 7.4
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Maven io.netty:netty-handler-ssl-ocsp · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56820 · GHSA-272m-gcwp-mpwg
- High, CVSS 8.3
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
Maven io.netty:netty-codec-xml · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56817 · GHSA-4qhr-g3c6-fcfx
- High, CVSS 7.5
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Maven io.netty:netty-codec-http3 · Upgrade to 4.2.16.Final or later · < 4.2.16.Final · CVE-2026-56816 · GHSA-hpcc-26xq-25fv
- Medium, CVSS 6.5
Netty: Security Control Bypass via CORS Short-Circuit Failure
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final · CVE-2026-56746 · GHSA-6cqp-g7gg-8hr5
- High, CVSS 8.7
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-56745 · GHSA-jppx-w49h-x2qq
- Medium, CVSS 6.3
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Packagist dompdf/dompdf · Upgrade to 3.1.6 or later · < 3.1.6 · CVE-2026-56722 · GHSA-cx96-42px-69fm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.