CVE-2026-85172

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1

Description A server-side request forgery (SSRF) issue exists in the legacy request helper function used by Code and Function nodes. The system validates the uri property for safety, but the HTTP client utilizes the url property if both are provided. This discrepancy allows an attacker to bypass security checks by providing a legitimate uri and a malicious url to access internal network addresses.

Recommendations Update to version 2.34.1 or later. As a temporary mitigation, restrict the use of the legacy request helper function within Code and Function nodes.