SelfHostRadar

n8n patch status

The latest n8n releases and security advisories, pulled from GitHub at build time. Data fetched 2026-10-18 (UTC).

Latest stable2.43.7Released 2026-10-16
Latest pre-release2.44.3Released 2026-10-16
Stable releases, last 30 days24From the releases we fetched

Hosts and version lag

We can only measure lag when a host shows which n8n version it runs. Most do not yet, so they show "Not yet checked".

HostStatusDetails
n8n Cloud Claims current Run by n8n. Should match the cloud release.
Hostinger Not yet checked Not yet checked
Elestio Not yet checked Not yet checked
Railway Not yet checked Not yet checked
DigitalOcean You update Latest at deploy. After that, you update it.
Hetzner Cloud You update You pick the version and update it.
OVHcloud Not yet checked Not yet checked
PikaPods Not yet checked Not yet checked
InstaPods Not yet checked Not yet checked
Selfhost.dev Not yet checked Not yet checked
n8nautomation.cloud Claims current Host says it updates n8n for you. Not yet measured.
Sliplane Not yet checked Not yet checked
Render Not yet checked Not yet checked
Contabo Not yet checked Not yet checked
Sevalla Not yet checked Not yet checked
xCloud You update You pick the version and update it.
Coolify You update You pick the version and update it.
Vultr Marketplace Not yet checked Not yet checked
Akamai (Linode) Marketplace Not yet checked Not yet checked
Docker on your own server You update You pick the version and update it.

Recent security advisories

PublishedSeverityAdvisoryFixed in
2026-10-14medium OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
GHSA-mgpr-56r4-5c67		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
GHSA-8vrr-mgc5-jg55		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
GHSA-crfj-5wv6-8v86		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
GHSA-8crx-5h96-q72q		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
GHSA-v9cx-v88r-42vw		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Per-User Credential Theft via Error-Workflow Execution Context Inheritance
GHSA-pcr3-v5vr-qppf		 >= 2.42.2, >= 2.41.5
2026-10-14medium Local Gateway Deep-Link Connect Silently Re-pairs to Attacker-Controlled Instance
GHSA-cwm2-vhf5-27q9		 >= 2.42.1, >= 2.41.4
2026-10-14medium Unauthenticated Slack Token Exfiltration and Full-Response SSRF via the Slack Trigger Webhook
GHSA-3c3p-5959-3ghr		 >= 1.123.83, >= 2.42.1, >= 2.41.4
2026-10-14medium Chat Hub: chat-only users can register tool types the product already tries to sandbox
GHSA-43v8-hjhm-chjp		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Quick Base Node Allows Filter Injection Through the Where Parameter
GHSA-65mv-v8rp-54wc		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14medium Credential Secrets Exposed in Execution Error Data of Several Nodes
GHSA-qmvv-q3c9-wpp7		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14high Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
GHSA-m7gv-mpg5-7c9v		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14high Crafted Workflow ID Gives Access to Data Tables in Other Projects
GHSA-wvjj-qg37-pv73		 >= 2.44.1, >= 2.43.5
2026-10-14high Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
GHSA-mp7q-23hg-35cf		 >= 1.123.85, >= 2.44.1, >= 2.43.5
2026-10-14high Prototype Pollution in Workflow History Compaction Causes Denial of Service
GHSA-fvv4-gmv9-xqf5		 >= 2.41.4

Recent stable releases

Sources: n8n releases on GitHub, n8n security advisories.

Get price drops and n8n patch alerts

One short email a week. What changed in n8n hosting, and which hosts have patched.