n8n published [email protected] on 2 September 2026. The notes list one core bug fix. The project pins browserslist to 4.28.7 to clear CVE-2026-73088 and CVE-2026-73089. This is a dependency pin on the 1.123 line, not a workflow engine feature release.
The full release notes and downloads are on the GitHub release page.
The pnpm override that pins browserslist 4.28.7 ¶
The patch is commit 9de4cce. It does not add browserslist as a new direct dependency of an n8n package. It appends one line to the root package.json pnpm.overrides map:
"browserslist@<4.28.7": "4.28.7"
pnpm then rewrites every matching transitive copy at install time. The same commit updates pnpm-lock.yaml. The compare range from [email protected] is that override plus the lockfile.
That is the right shape for a CVE that lives several layers down. A direct "browserslist": "4.28.7" in one workspace package would miss other copies. An override is global for the install.
browserslist is a query library that front end tools use to share target browsers and Node.js versions. Callers pass strings such as defaults or since YYYY-MM-DD. n8n does not document a workflow node that takes those strings. The library still lands in node_modules because the editor and build toolchain pull it in. Image scanners that walk the installed tree will keep reporting the two CVEs until the override is present in the artifact you run, not only in a git checkout you never install.
If you vendor node_modules or bake an image from an older lockfile, pulling the git tag is not enough. Reinstall with pnpm so browserslist@<4.28.7 resolves to 4.28.7, then rebuild the image.
Prototype pollution in normalizeStats ¶
CVE-2026-73088 is in normalizeStats() inside browserslist node.js. getStat() and loadStat() call it on every browserslist() invocation, including queries that never mention stats. Untrusted input arrives as browserslist-stats.json, opts.stats, or CLI --stats.
The old loop used for...in over that object and assigned into a plain object with bracket notation. Inherited Object.prototype keys (__proto__, toString, valueOf, constructor, hasOwnProperty, isPrototypeOf) produced an uncaught TypeError or wrote the prototype of the returned map. A crash kills the Node.js process that made the call. A prototype write corrupts later lookups on that object.
4.28.7 allocates the map with Object.create(null) and checks own properties with Object.prototype.hasOwnProperty.call(). NVD rates the issue 7.5 under CVSS 3.1, availability high.
For a self hosted n8n host the plausible path is a poisoned stats file next to a build or editor process, not a production webhook. The notes do not claim the workflow runtime parses browserslist-stats.json on each execution. Do not treat this as remote code execution in the worker. Treat it as an uncaught exception and a prototype write in a library the image still ships.
Unbounded query cache and process OOM ¶
CVE-2026-73089 is the second ID in the same bump. index.js stored every distinct (queries, context) result in cache and every parseQueries() AST in parseCache. There was no size cap, TTL, or eviction. Valid queries of the form since <year>-<month>-<day> are enough to create distinct keys. Sustained distinct queries grow memory until the process is killed with out of memory.
BROWSERSLIST_DISABLE_CACHE does not cap parseCache, so that environment variable is not a full workaround. n8n did not add its own cache limit. The project cleared the finding by taking 4.28.7.
This is a volume problem. A single short payload is not the issue. It matters if some process in the image calls browserslist() on many distinct attacker influenced query strings. Ordinary n8n traffic is workflow runs, queue workers, and the REST API. Those paths do not take browserslist query language. The pin still matters for scanner gates and for any CI job that runs the editor build inside the same tree.
What this tag does not change ¶
The notes are one bullet. The GitHub release page lists no breaking change and no migration step.
[email protected] is a patch on [email protected]. Queue behavior, webhook auth, credential encryption, and node execution are not in the diff. If you are waiting on a runtime fix, this tag will not provide it.
Install over 1.123.75, reinstall dependencies so the override applies, and rebuild whatever image or filesystem you actually execute. Forks that pin browserslist themselves should not select a version below 4.28.7.