n8n published two high-severity security advisories on 28 October 2026. One concerns image processing in the official Docker image. The other concerns deprecated nodes that can run code in the main n8n process. Both require action from people who host n8n themselves.
What to do now
- Check the version shown in your n8n settings or deployment manifest. If you stay on the 2.45 line, update to 2.45.5 or later; the current release page lists 2.45.7. Other patched lines are named in the GraphicsMagick advisory and the deprecated-node advisory.
- Search your workflows for Edit Image, Function, Function Item and LangChain Code nodes. Replace the three deprecated code nodes with the Code node. The n8n advisory says previously saved workflows keep running, so an update does not remove that review task.
- Until you can update, do not process untrusted images with Edit Image. Keep the default block on deprecated nodes enabled. n8n documents temporary mitigations in the GraphicsMagick advisory.
- After updating, restart the instance and confirm the running version. Then run one known workflow through its normal path and inspect the execution log.
Why this is urgent
The image issue affects GraphicsMagick in the official n8n Docker image. According to the maintainer advisory, processing an untrusted image with Edit Image could lead to remote code execution on the n8n instance. That is relevant to workflows accepting attachments, uploads or images from people outside the business.
The second issue needs an authenticated user who may create or modify workflows. The old Function, Function Item and LangChain Code nodes can execute code outside the isolation used by the current Code node. n8n blocks those deprecated nodes by default in patched releases, but existing saved workflows continue to run. That is why updating and inventorying the workflows belong together.
This is not a reason to abandon self-hosting. It is the operational cost that comes with it: the owner of the instance also owns updates, backups and the review of exposed workflows. Managed n8n Cloud customers should follow n8n's service guidance; self-hosters need to verify their own running version.