How to Patch n8n October 28, 2026 Security Advisories: Self-Hosted Upgrade Guide

Introduction

If you self-host n8n, October 28, 2026 added a second urgent entry to your October maintenance calendar. n8n published 12 new security advisories, three of them rated High, and the worst of the three breaks the isolation that is supposed to keep workflow code away from the n8n host process. This tutorial is the hands-on companion to that batch: which advisories matter, the exact patch version for each release line, how to check whether you are exposed, and how to upgrade a production instance without losing data.

Quick answer

Upgrade to 1.123.89, 2.45.5, 2.46.1, or 3.0.1 (matching your release line). Back up the database and encryption key first, then pull the patched image and recreate the container.

Evidence

Before the steps, the numbers that justify a maintenance window instead of waiting for the next routine update.

First, the batch itself. On October 28, 2026, n8n published 12 security advisories, three rated High and the rest Moderate, as listed in the project’s October 28 security update post. The three High advisories are the deprecated code nodes escaping into the main process, insufficient isolation in workflow expression evaluation, and an insecure GraphicsMagick configuration bundled in the official Docker image. n8n’s own advice in that post is blunt, and worth quoting exactly: “If you are running a self-hosted n8n instance on a version below the fixed versions listed above, we recommend upgrading at your earliest convenience.”

Second, the severity. The deprecated code node advisory, GHSA-9p7v-45m2-wxgj, carries a CVSS score of 8.7 as of November 2026. The reason is architectural: the deprecated Function and Function Item nodes run user code in a vm2 sandbox, and the LangChain Code node runs it in the main n8n process, outside the task runner isolation that protects the current Code node. A workflow author who can create and run workflows can therefore reach code execution on the host, which is exactly the boundary self-hosting is supposed to enforce.

Third, the GraphicsMagick advisory reaches beyond authenticated users. The advisory, GHSA-f2cw-9483-7vcp, covers known vulnerabilities in the GraphicsMagick build inside the official n8n Docker image, and processing an untrusted image with the Edit Image node could lead to remote code execution. A workflow that passes images from an unauthenticated Webhook node into Edit Image puts that flaw within reach of anyone on the internet who can send an image to the webhook, with no n8n account needed. That combination, public input plus image processing, is the first thing to audit on any internet-facing instance.

Fourth, the expression evaluation advisory closes a second isolation gap. The advisory, GHSA-gx3v-3x3v-f8r5, describes insufficient isolation in workflow expression evaluation, which again lets a user who can create or edit workflows escape the sandbox and run code on the host. Taken together, the October 28 batch is not a set of edge cases. Two of its three High advisories break the same promise, that workflow content stays inside its sandbox, and the third turns a common image workflow into a public entry point. Everything below follows the advisories’ own patch and workaround sections, so you are following vendor guidance, not folklore.

Prerequisites

• A self-hosted n8n instance (Docker Compose, plain Docker, or npm install); n8n Cloud users are already patched.
• SSH or terminal access to the host running n8n.
• A recent backup of the n8n database (SQLite file or Postgres dump) and your N8N_ENCRYPTION_KEY. Without the key, a failed upgrade can lock you out of stored credentials permanently.
• Know which release line you run: 1.x, stable 2.x, beta 2.x, or 3.x. Check in the n8n UI under Settings, or run n8n --version on the host.

Step-by-step guide

Step 1: Confirm your current version and your patch floor

Run the version check on the host:

docker exec <n8n-container-name> n8n --version

Compare the result against the October 28 patch floors:

If your version is below the floor for your line, you are missing at least one October 28 fix. Note that this floor is higher than the October 14, 2026 security bulletin, which needed only 1.123.85, 2.43.5, or 2.44.1. Patching in mid-October does not cover this batch. If you upgrade after October 29, you may land on a newer point release such as 2.45.6 or 1.123.90, and that is fine, because those releases build on the same advisory floor rather than replacing it.

Step 2: Audit for deprecated code nodes before you touch anything

The patch changes the behavior of three deprecated nodes: Function, Function Item, and LangChain Code. Workflows already saved with those nodes keep running after the patch, but saving a workflow that adds or changes one of them is rejected. That means the upgrade itself will not break running workflows, but the next edit to an affected workflow will fail until you migrate it to the current Code node. Find those workflows now, while you still can edit them on the old version.

Export all workflows and search the JSON for the deprecated node types:

n8n export:workflow --all --output=/tmp/n8n-workflows-backup/
grep -rl "n8n-nodes-base.function" /tmp/n8n-workflows-backup/ | head
grep -rl "functionItem" /tmp/n8n-workflows-backup/ | head

Open every match and note which workflows contain the old nodes. For each one, decide the migration now: rewrite the node as a current Code node and test it in a staging copy, or accept that the workflow becomes read-only in practice until you do. This export doubles as a pre-upgrade workflow backup, so keep the directory until the upgrade is verified.

Do not plan around the escape hatch. The advisory documents an environment variable, N8N_DEPRECATED_NODES_BLOCK=false, that restores the old behavior, but setting it reintroduces the exact vulnerability the patch removes. Treat that variable as a diagnostic tool for a staging instance only, never as a production setting. If a workflow cannot be migrated yet, the safer interim step is Step 5, excluding the node type, combined with restricting who can create and edit workflows.

Step 3: Audit public webhooks that feed the Edit Image node

This is the one October 28 flaw an outsider can reach without an account, so audit it separately from the authenticated-user flaws. In the n8n editor, list every workflow with a Webhook trigger, then trace each one forward: does any path pass the incoming binary data into an Edit Image node? The dangerous pattern is an unauthenticated webhook (no authentication method set on the trigger) whose binary output flows into Edit Image, because the attacker controls the image bytes that GraphicsMagick parses.

If you find that pattern, deactivate the workflow immediately, before the upgrade. After patching, re-enable it only if the webhook genuinely needs to accept public images, and consider adding authentication to the trigger or moving image intake behind a service that validates uploads first. If the workflow does not need Edit Image at all, remove the node from the workflow rather than leaving a public image path in place.

Step 4: Back up the database and the encryption key

For the default SQLite setup, stop writes first, then copy the database file and confirm the encryption key is stored somewhere outside the container:

docker stop <n8n-container-name>
cp ~/.n8n/database.sqlite ~/.n8n/database.sqlite.pre-oct28-patch.bak
echo "$N8N_ENCRYPTION_KEY" | wc -c   # should print a number well above 1; 1 means empty
docker start <n8n-container-name>

For Postgres, take a pg_dump instead. The full backup routine is covered in our self-hosted n8n update guide; do not skip it, because a failed migration without the key means locked credentials. Keep the workflow export from Step 2 alongside this backup, so a rollback restores both data and workflow definitions.

Step 5: Apply interim mitigations if the upgrade must wait

If production cannot restart today, apply the advisories’ own stopgaps, and treat them as a bridge to patching, not a substitute. First, restrict workflow creation and editing to fully trusted users, and remove editor access from anyone who does not need it. Second, exclude node types you do not need by adding them to the NODES_EXCLUDE environment variable, which n8n’s environment variable reference documents. For an instance that never processes images, excluding the Edit Image node closes the public GraphicsMagick path:

environment:
  - NODES_EXCLUDE=n8n-nodes-base.editImage

Apply the same technique to the deprecated code node types if no workflow needs them, using the exact node type strings from your Step 2 workflow export. Third, deactivate any workflow that feeds an unauthenticated webhook into Edit Image, as found in Step 3. Recreate the container after changing the variable, and confirm the excluded nodes no longer appear in the editor.

Step 6: Upgrade to the patched version for your line

Docker Compose (recommended): pin the image to at least the patched floor for your line, then recreate:

# in docker-compose.yml, set e.g. image: n8nio/n8n:2.45.5
docker compose pull
docker compose up -d

Use 3.0.1 if you track the 3.x line, 2.46.1 for beta 2.x, 2.45.5 for stable 2.x, and 1.123.89 for 1.x. Do not jump release lines in the same window unless you have already tested that jump in staging, because major-line upgrades carry their own breaking changes on top of the security fix.

Plain Docker: stop and remove the old container, then run the new image with the same volumes and environment variables. Keep the volume mounts identical, because the database and encryption key live outside the container image.

npm install: stop the n8n process, update the package to the patched version for your line, and restart. Confirm the version with n8n --version before opening the editor to users again.

Step 7: Verify the patch and re-check the affected workflows

After the container restarts, verify three things before declaring the window closed. First, confirm the running version is at or above your line’s floor:

docker exec <n8n-container-name> n8n --version

Second, open one workflow from your Step 2 list and confirm it still runs, then try saving a test copy with a newly added deprecated node and confirm the save is rejected. That rejection is the patch working, not a bug, and it proves the block is active. Third, re-check the Step 3 webhooks: any workflow you deactivated should stay deactivated until you have decided whether its public image path is acceptable on the patched version.

Finally, update your maintenance habit. n8n published advisory batches in September 2026, on October 14, 2026, and again on October 28, 2026, which means the project’s security rhythm is now roughly every two weeks. Several of these advisories are GitHub Security Advisories without CVE IDs, the same pattern that made dependency scanners blind to earlier batches. If your patch process depends on npm audit or Dependabot turning red, it will miss this batch too, so a calendar reminder to check the advisories index beats any scanner for this particular project. Our self-hosted n8n security hardening guide covers the longer-term lockdowns, such as reverse proxy authentication and credential hygiene, that reduce the blast radius of the next batch.

Troubleshooting

The upgrade succeeds, but saving an old workflow now fails

This is the deprecated node block working as intended. The patch rejects saves that add or change a Function, Function Item, or LangChain Code node. Open the workflow, replace the deprecated node with a current Code node, copy the logic across, and test the workflow in a staging copy before saving. Do not set N8N_DEPRECATED_NODES_BLOCK=false in production to get the save through, because that restores the vulnerable behavior the patch exists to remove.

The container restarts, but the version is unchanged

This usually means the image tag in docker-compose.yml still pins the old version, or docker compose pull pulled nothing because the tag is a floating alias your cache already satisfies. Check the image line in the compose file, set it explicitly to the patched version for your line, run docker compose pull again, and confirm with docker exec <n8n-container-name> n8n --version. If the version still does not move, check that you recreated the container with docker compose up -d rather than only restarting the old one.

Workflows fail after upgrade with credential errors

A credential failure after an upgrade usually points to a missing or changed encryption key, not to the security patch itself. Confirm N8N_ENCRYPTION_KEY in the container environment matches the value used before the upgrade, and check that the database volume mounted correctly. If the key is wrong, restore the pre-upgrade database backup from Step 4, restore the original key, and restart. Never re-enter every credential by hand as a first resort, because a key mismatch will break them again on the next restart.

The Edit Image node disappeared from the editor

That is the NODES_EXCLUDE mitigation from Step 5 still active, not a patch side effect. If the exclusion was intentional, leave it in place, because it closes the public GraphicsMagick path. If image processing is needed again, remove the node type from NODES_EXCLUDE, recreate the container, and re-check that no unauthenticated webhook feeds the node before re-enabling affected workflows.

Conclusion

The October 28, 2026 batch is a patch-now batch, not a patch-eventually batch: two High advisories break workflow sandbox isolation, and the third turns public image uploads into a host risk. Upgrade to 1.123.89, 2.45.5, 2.46.1, or 3.0.1 for your release line, migrate the deprecated code nodes before their next edit, and close any public webhook path into Edit Image. Next, work through our complete n8n guide to harden the instance you just patched.

Frequently asked questions