n8n 1.123.62 - Security Fixes for Workflow Operators

n8n [email protected] was published on June 29, 2026, as a security patch for workflow automation operators. The n8n 1.123.62 release lists one bug fix: five security issues fixed in hono, vue-i18n, and linkify-it, with no feature work or migration note attached. This release is not marked as a prerelease.

The full release notes and downloads are on the GitHub release page.

The release notes cite a single pull request, #33164, and commit e325585. The linked note says the patch fixes five security issues in hono, vue-i18n, and linkify-it.

For data engineering teams, that scope matters because n8n is usually not a quiet library in a build file. It is a workflow runtime with browser access, webhook entry points, credentials, queue workers, and scheduled jobs around it. A dependency security patch in that stack should be treated as runtime maintenance, not as a cosmetic update.

The release note does not list CVE identifiers, exploit paths, or affected n8n features. That limits what can be said without inventing detail. The useful reading is narrower: this tag moves the dependency security state for those three packages, and operators should validate the paths they expose rather than assume a behavior change.

The release note identifies hono as an affected package, so HTTP handling deserves a quick smoke test. In n8n, webhook traffic and editor API access often cross trust boundaries through ingress rules, auth layers, and reverse proxy policy. The note does not say that webhook behavior changed, so the practical check is compatibility: existing HTTP triggers, auth flows, and API calls should behave the same after the patch.

vue-i18n is a browser side dependency. For platform teams, that points attention at the editor and admin UI rather than the worker path. A security update here still matters because the n8n UI is where workflow definitions, credentials, run history, and node configuration are viewed and edited.

linkify-it is used for turning text into links. The release note does not state where n8n calls it, but the package class is relevant to any UI that renders user supplied text. Test workflow descriptions, error text, execution output, and any local conventions that display operator notes.

This release is small enough that the rollout plan should be direct. Pin the tag, deploy it through the same path used for prior n8n patches, and watch the surfaces that touch the named dependency classes. That means the editor UI, webhook execution, API calls through the ingress, and any automation that depends on rendered links or translated UI strings.

There is no signal in the release notes about a database schema change, queue semantics, node behavior, credential format, or breaking change. If your estate has strict change control, classify this as a security maintenance rollout with normal smoke coverage.

The absence of detail is also a risk. Operators that need audit evidence should capture the exact tag, the release URL, the cited issue, and the commit hash in the change record. The GitHub release page is the source of record for this tag.