Skip to content
QuenchWorks

n8n

Chart · Workflow · standard · v0.1.7

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-08-02

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Version

0.1.7 · latest0.1.60.1.50.1.40.1.30.1.20.1.10.1.0

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Deployed image digest

sha256:5c8e6d281041e0d9b2063c24911f5129d683f714a1cc967fdde9cd7eedb5daec

Chart OCI version

oci://ghcr.io/quenchworks/charts/n8n:0.1.7

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed
cosign keyless
SBOM
SPDX, on image
Provenance
SLSA build
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only
Image size
398.7 MB

Security report (Trivy)

D· 0/10011 fixable · rebuild clears them

Vulnerability detail

n8n 2.32.7 · 14 CVE
CVESeverityPackageInstalledFixed inTitle
CVE-2026-58043HIGHnodejs-2222.23.1-r122.23.2-r0nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
CVE-2026-67213HIGHnanoid3.3.163.3.17, 5.1.6nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customA ...
CVE-2026-67213HIGHnanoid3.3.83.3.17, 5.1.6nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customA ...
CVE-2026-67214HIGHnanoid3.3.83.3.16, 5.1.16nanoid (Nano ID) before 5.1.16 contains an infinite loop in the custom ...
CVE-2026-69152HIGHbrace-expansion5.0.81.1.18, 2.1.4, 3.0.6, 5.0.9brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
CVE-2026-56850MEDIUMnodejs-2222.23.1-r122.23.2-r0nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
CVE-2026-69207MEDIUMhono4.12.334.12.34Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-71848MEDIUMhono4.12.334.12.34Hono: Algorithmic Complexity DoS in Language Middleware
CVE-2026-71850MEDIUMhono4.12.334.12.34Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
CVE-2024-1899MEDIUMshowdown2.1.0— not fixableShowdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2026-59710MEDIUMshowdown2.1.0— not fixableshowdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711MEDIUMshowdown2.1.0— not fixableshowdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-56847LOWnodejs-2222.23.1-r122.23.2-r0A flaw in Node.js Permission Model enforcement allows `trace_events.cr ...
CVE-2026-71849LOWhono4.12.334.12.34Hono: Proxy Helper does not remove response headers listed in the `Connection` header
0
Critical
5
High
7
Medium
2
Low
0
Unknown

Security report (Trivy) · image n8n 2.32.7

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-n8n oci://ghcr.io/quenchworks/charts/n8n --version 0.1.7

Deploys image (digest-pinned)

ghcr.io/quenchworks/images/n8n@sha256:5c8e6d281041e0d9b2063c24911f5129d683f714a1cc967fdde9cd7eedb5daec
ghcr.io/quenchworks/images/n8n-runners@sha256:e2aa10949dd811520f6eb7eb6417c490dcca903801f04a351babc2f5bfc7ce07
Chart version
0.1.7
App version
2.32.7
Chart license
LicenseRef-n8n-Sustainable-Use-License-1.0
App license
LicenseRef-n8n-Sustainable-Use-License-1.0
Service port
5678
Signed
cosign (keyless)
Values schema
yes
Last published
2026-08-02

Verify the chart

cosign verify ghcr.io/quenchworks/charts/n8n:0.1.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the imageView on ArtifactHubChart source

Upstream project: https://n8n.io