---
id: CVE-2026-85172
title: >-
  n8n versions before 2.34.1 contain a server-side request forgery vulnerability
  in the legacy request helper function exposed to Code and Function nodes
summary: >-
  n8n versions before 2.34.1 contain a server-side request forgery vulnerability
  in the legacy request helper function exposed to Code and Function nodes. The
  validation logic checks the uri property for SSRF safety while the underlying
  HT…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
vendor: n8n
product: n8n
affected:
  - n8n < 2.33.4
  - n8n = 2.34.0
patched:
  - n8n 2.33.4
published: '2026-09-03'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T21:26:46.583'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85172'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-jp9j-jr97-w9pj'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-2.34.1-ssrf-via-request-helper-uri-validation-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00261
epssPercentile: 0.15936
ingestedAt: '2026-09-08T21:11:12.290Z'
---

## Overview

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present, allowing attackers to bypass validation by supplying a safe uri alongside a malicious url to access internal addresses.

## Affected

- `n8n < 2.33.4`
- `n8n = 2.34.0`

## Remediation

Upgrade past the affected range:

- `n8n 2.33.4`