n8n

Image · Workflow · standard · v2.40.7

F 26cosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-04

Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.

Current digest (deployed by the chart)

sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Signatures, the SBOM, and provenance all attach to this digest. Pin to it for reproducible, tamper-evident pulls.

Image

ghcr.io/quenchworks/images/n8n:2.40.7

Signed

cosign keyless

SBOM

SPDX, on digest

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

418.7 MB

Published versions

1 tag

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Version	Size	Published	Digest
2.40.7latest	418.7 MB	2026-10-04	sha256:cfb73b45037c…

Security report (Trivy)

F· 0/10019 fixable · rebuild clears them

Vulnerability detail

n8n 2.40.7 · 26 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-100721	CRITICAL	vm2	3.11.7	3.12.2	vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-102828	CRITICAL	simple-git	3.36.0	4.0.1	simple-git: simple-git unsafe-operation guard does not block trailer command configuration
CVE-2026-102829	CRITICAL	@simple-git/argv-parser	1.1.1	2.0.1	simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CVE-2026-92934	CRITICAL	vm2	3.11.7	3.11.8	vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92953	CRITICAL	vm2	3.11.7	3.11.8	vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92954	CRITICAL	vm2	3.11.7	3.11.8	vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92955	CRITICAL	vm2	3.11.7	3.11.8	vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-100722	HIGH	vm2	3.11.7	3.12.2	vm2: vm2: Denial of Service via unhandled Promise rejection in construct trap
CVE-2026-102826	HIGH	simple-git	3.36.0	4.0.0	simple-git: simple-git allows command execution through unblocked Git configuration includes
CVE-2026-102827	HIGH	simple-git	3.36.0	4.0.0	simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CVE-2026-104850	HIGH	@modelcontextprotocol/sdk	1.26.0	1.31.0	MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-87776	HIGH	compression	1.8.1	1.8.2	compression: compression: Denial of Service via memory leak on premature response close
CVE-2026-92959	HIGH	vm2	3.11.7	3.11.8	vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation
CVE-2026-93687	HIGH	braces	3.0.3	— not fixable	braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns
CVE-2026-100723	MEDIUM	vm2	3.11.7	3.12.2	vm2: vm2: Information disclosure via zlib shared buffer pool
CVE-2026-104182	MEDIUM	stream-json	3.5.0	3.6.0	stream-json: stream-json: Denial of Service via inefficient comment scanning
CVE-2026-104183	MEDIUM	stream-json	3.5.0	3.6.0	stream-json: stream-json: Object prototype manipulation via crafted JSON input
CVE-2026-86597	MEDIUM	snowflake-sdk	2.1.0	3.3.0	Snowflake drivers writes sensitive information to logs
CVE-2026-92933	MEDIUM	vm2	3.11.7	3.11.8	vm2: vm2: Information Disclosure via util.getCallSites
CVE-2024-1899	MEDIUM	showdown	2.1.0	— not fixable	Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
CVE-2025-57665	MEDIUM	element-plus	2.4.3	— not fixable	Element Plus Link component (el-link) implements insufficient input validation for the href attribute
CVE-2026-59710	MEDIUM	showdown	2.1.0	— not fixable	showdown: Showdown: Stored Cross-Site Scripting via unescaped table header ID attributes in markdown
CVE-2026-59711	MEDIUM	showdown	2.1.0	— not fixable	showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
CVE-2026-97058	MEDIUM	sprintf-js	1.0.3	— not fixable	sprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-97058	MEDIUM	sprintf-js	1.1.3	— not fixable	sprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
CVE-2026-105799	LOW	@langchain/redis	1.0.1	1.1.1	LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

Critical

High

Medium

Low

Unknown

fixable per nightly scan · peak 4157 of 100 days with any · 2026-06-29 to 2026-10-07

Pull the image

Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.

Pull (tag)

docker pull ghcr.io/quenchworks/images/n8n:2.40.7

Pinned by digest (recommended)

docker pull ghcr.io/quenchworks/images/n8n@sha256:cfb73b45037c7f9fdfd1294b9cc0e33eb515b495c654f4fc520b4ba89c2c091e

Tags

2.40.72.40.7-amd642.40.7-arm64

Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.

App version: 2.40.7
Architectures: amd64, arm64
Runs as: nonroot (uid 1001)
Root filesystem: read-only
License: LicenseRef-n8n-Sustainable-Use-License-1.0

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/n8n:2.40.7 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Transparency

Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).

View the Helm chart View package

Upstream project: https://n8n.io