Skip to content
QuenchWorks

n8n

Image · Workflow · standard · v2.40.7

F 43cosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-04

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Current digest (deployed by the chart)

sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Signatures, the SBOM, and provenance all attach to this digest. Pin to it for reproducible, tamper-evident pulls.

Image
ghcr.io/quenchworks/images/n8n:2.40.7
Signed
cosign keyless
SBOM
SPDX, on digest
Provenance
SLSA build
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only
Image size
418.7 MB

Published versions

1 tag

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

VersionSizePublishedDigest
2.40.7latest418.7 MB2026-10-04sha256:cfb73b45037c…

Security report (Trivy)

F· 0/10036 fixable · rebuild clears them

Vulnerability detail

n8n 2.40.7 · 43 CVE
CVESeverityPackageInstalledFixed inTitle
CVE-2026-100721CRITICALvm23.11.73.12.2vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-102828CRITICALsimple-git3.36.04.0.1simple-git: simple-git unsafe-operation guard does not block trailer command configuration
CVE-2026-102829CRITICAL@simple-git/argv-parser1.1.12.0.1simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CVE-2026-106445CRITICALhandlebars4.7.94.7.10handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass
CVE-2026-106446CRITICALhandlebars4.7.94.7.10handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CVE-2026-92934CRITICALvm23.11.73.11.8vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92953CRITICALvm23.11.73.11.8vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92954CRITICALvm23.11.73.11.8vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92955CRITICALvm23.11.73.11.8vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-93605CRITICALvm23.11.73.12.1vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
CVE-2026-100722HIGHvm23.11.73.12.2vm2: vm2: Denial of Service via unhandled Promise rejection in construct trap
CVE-2026-102826HIGHsimple-git3.36.04.0.0simple-git: simple-git allows command execution through unblocked Git configuration includes
CVE-2026-102827HIGHsimple-git3.36.04.0.0simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CVE-2026-104850HIGH@modelcontextprotocol/sdk1.26.01.31.0@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials
CVE-2026-87776HIGHcompression1.8.11.8.2compression: compression: Denial of Service via memory leak on premature response close
CVE-2026-92959HIGHvm23.11.73.11.8vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation
CVE-2026-93687HIGHbraces3.0.3— not fixablebraces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns
CVE-2026-100723MEDIUMvm23.11.73.12.2vm2: vm2: Information disclosure via zlib shared buffer pool
CVE-2026-104182MEDIUMstream-json3.5.03.6.0stream-json: stream-json: Denial of Service via inefficient comment scanning
CVE-2026-104183MEDIUMstream-json3.5.03.6.0stream-json: stream-json: Object prototype manipulation via crafted JSON input
CVE-2026-106119MEDIUM@langchain/mongodb1.0.11.3.1LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
CVE-2026-106444MEDIUMhandlebars4.7.94.7.10handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates
CVE-2026-86597MEDIUMsnowflake-sdk2.1.03.3.0Snowflake drivers writes sensitive information to logs
CVE-2026-8674MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-86805MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-89092MEDIUMglibc-2.442.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092MEDIUMld-linux-2.442.44-r72.44-r8glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-92933MEDIUMvm23.11.73.11.8vm2: vm2: Information Disclosure via util.getCallSites
CVE-2026-95818MEDIUMglibc-2.442.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818MEDIUMglibc-2.44-locale-posix2.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818MEDIUMld-linux-2.442.44-r72.44-r8glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2024-1899MEDIUMshowdown2.1.0— not fixableShowdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2025-57665MEDIUMelement-plus2.4.3— not fixableElement Plus Link component (el-link) implements insufficient input validation for the href attribute
CVE-2026-59710MEDIUMshowdown2.1.0— not fixableshowdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711MEDIUMshowdown2.1.0— not fixableshowdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-97058MEDIUMsprintf-js1.0.3— not fixablesprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-97058MEDIUMsprintf-js1.1.3— not fixablesprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-105799LOW@langchain/redis1.0.11.1.1LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
10
Critical
7
High
25
Medium
1
Low
0
Unknown
fixable per nightly scan · peak 4161 of 104 days with any · 2026-06-29 to 2026-10-11

Pull the image

Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.

Pull (tag)

docker pull ghcr.io/quenchworks/images/n8n:2.40.7

Pinned by digest (recommended)

docker pull ghcr.io/quenchworks/images/n8n@sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Tags

2.40.72.40.7-amd642.40.7-arm64

Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.

App version
2.40.7
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only
License
LicenseRef-n8n-Sustainable-Use-License-1.0

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Transparency

Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).

View the Helm chartView package

Upstream project: https://n8n.io